ci: merge publish job into test workflow for guaranteed serial execution

Author: bramp

.github/workflows/publish.yml

@@ -1,6 +1,3 @@
-# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-maven
-
 name: Java CI with Maven
 
 on:
@@ -9,47 +6,82 @@ on:
     tags: [ "ffmpeg-*" ]
   pull_request:
     branches: [ "master" ]
+  workflow_dispatch:
+    inputs:
+      skipTests:
+        description: 'Skip tests during publish'
+        required: false
+        default: 'false'
 
 jobs:
-  build:
+  test:
     runs-on: ubuntu-latest
-    # Enable debugging to help resolve:
-    # https://github.com/federicocarboni/setup-ffmpeg/issues/19
-    environment: debug
     strategy:
       fail-fast: false
       matrix:
-        # Long term supported versions
         java-version: [11, 17, 21]
 
-        # TODO Should we test locales? The old travis setup did, see:
-        # https://github.com/bramp/ffmpeg-cli-wrapper/pull/55
-
     name: JDK ${{ matrix.java-version }}
 
     steps:
-    - uses: actions/checkout@v6
-
-    - name: Set up FFmpeg
-      uses: FedericoCarboni/setup-ffmpeg@v3
-      id: setup-ffmpeg
-      with:
-        ffmpeg-version: release
-
-    - name: Set up JDK ${{ matrix.java-version }}
-      uses: actions/setup-java@v5
-      with:
-        java-version: ${{ matrix.java-version }}
-        distribution: 'temurin'
-        cache: maven
-
-    - name: Compile with Maven
-      run: mvn --batch-mode --update-snapshots compile
-
-    - name: Test with Maven, Package and Verify with Maven
-      run: mvn --batch-mode --update-snapshots verify -Dgpg.skip
-
-    # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
-    - name: Update dependency graph
-      uses: advanced-security/maven-dependency-submission-action@v5
-      continue-on-error: true
+      - uses: actions/checkout@v4
+
+      - name: Set up FFmpeg
+        uses: FedericoCarboni/setup-ffmpeg@v3
+        with:
+          ffmpeg-version: release
+
+      - name: Set up JDK ${{ matrix.java-version }}
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: 'temurin'
+          cache: maven
+
+      - name: Test with Maven
+        run: mvn --batch-mode verify -Dgpg.skip -DskipTests=${{ github.event.inputs.skipTests || 'false' }}
+
+      - name: Update dependency graph
+        if: matrix.java-version == '21' && github.event_name == 'push' && github.ref == 'refs/heads/master'
+        uses: advanced-security/maven-dependency-submission-action@v4
+        continue-on-error: true
+
+  publish:
+    needs: test
+    # Only publish on tags (ffmpeg-*) or manual dispatch
+    # and only if it's not a pull request
+    if: |
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/ffmpeg-')) ||
+      (github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    environment: publish
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up FFmpeg
+        uses: FedericoCarboni/setup-ffmpeg@v3
+        with:
+          ffmpeg-version: release
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+          server-id: central
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase: GPG_PASSPHRASE
+          cache: 'maven'
+
+      - name: Publish to Sonatype Central Portal
+        run: |
+          mvn clean deploy \
+            -DskipTests=true \
+            --no-transfer-progress \
+            -P java11plus
+        env:
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}