use CD pipeline

.github/workflows/release.yml

@@ -3,43 +3,72 @@
 
 name: Automated Release
 on:
-  schedule:
-    - cron: 35 5 * * FRI
+  push:
+    branches: [main]
   workflow_dispatch:
+# Serialize release runs. Each run's release-notes lower bound is the latest tag
+# at the time its prepare job runs; two merges in quick succession would both
+# read that bound before either run has tagged, producing overlapping notes.
+# Queueing (no cancel) lets the earlier release finish and create its tag first,
+# so the next run's notes start from that tag and carry only its own commits.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
 jobs:
-  publish:
+  prepare:
+    name: Prepare Release
+    runs-on: ubuntu-latest
+    outputs:
+      needed: ${{ steps.gate.outputs.needed }}
+      version: ${{ steps.version.outputs.version }}
+      previous: ${{ steps.gate.outputs.last }}
+    steps:
+      - name: Clone Git Repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+      - id: gate
+        name: Check whether a release is needed
+        uses: metio/ci/needs-release@392a32762cd5626c0aa9e6e67414240a021b90ae # 2026.6.26153329
+        with:
+          paths: src/main/java pom.xml
+      - id: version
+        name: Compute the next version
+        if: steps.gate.outputs.needed == 'true'
+        uses: metio/ci/calver@392a32762cd5626c0aa9e6e67414240a021b90ae # 2026.6.26153329
+  release:
+    needs: [prepare]
+    if: needs.prepare.outputs.needed == 'true'
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # create the GitHub Release
     steps:
       - id: checkout
         name: Clone Git Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
-      - id: last_release
-        name: Fetch last release info
-        run: echo "tag=$(gh release view --json tagName --jq '.tagName')" >> $GITHUB_OUTPUT
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - id: commits
-        name: Count Commits
-        run: echo "count=$(git rev-list --count ${{ steps.last_release.outputs.tag }}..HEAD -- src/main/java pom.xml)" >> $GITHUB_OUTPUT
-      - id: release
-        name: Create Release Version
-        if: steps.commits.outputs.count > 0
-        run: echo "version=$(date +'%Y.%-m.%-d')" >> $GITHUB_OUTPUT
-      - id: sha
-        name: Last Commit
-        if: steps.commits.outputs.count > 0
-        run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
       - id: timestamp
         name: Build Timestamp
-        if: steps.commits.outputs.count > 0
         run: echo "iso8601=$(date --utc --iso-8601=seconds)" >> $GITHUB_OUTPUT
+      - id: notes
+        name: Generate Release Notes
+        uses: metio/ci/release-notes@392a32762cd5626c0aa9e6e67414240a021b90ae # 2026.6.26153329
+        with:
+          version: ${{ needs.prepare.outputs.version }}
+          previous: ${{ needs.prepare.outputs.previous }}
+      - name: Append usage and verification footer
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+          NOTES: ${{ steps.notes.outputs.file }}
+        run: |
+          cat >> "$NOTES" <<EOF
+
+          ## Usage
+
+          Pull the library from [Maven Central](https://central.sonatype.com/artifact/wtf.metio.devcontainer/devcontainer.java).
       - id: setup-java
         name: Set up Java
-        if: steps.commits.outputs.count > 0
         uses: actions/setup-java@v5
         with:
           java-version: 25
@@ -50,20 +79,17 @@
           server-password: MAVEN_CENTRAL_TOKEN
       - id: gpg
         name: GPG Key
-        if: steps.commits.outputs.count > 0
         uses: timheuer/base64-to-file@v2
         with:
           fileName: signing.key.asc
           fileDir: ${{ github.workspace }}
           encodedString: ${{ secrets.GPG_SECRET_KEY_BASE64 }}
       - id: pom-version
         name: Set Release Version
-        if: steps.commits.outputs.count > 0
-        run: mvn --batch-mode --define newVersion=${{ steps.release.outputs.version }} --define generateBackupPoms=false versions:set
+        run: mvn --batch-mode --define newVersion=${{ needs.prepare.outputs.version }} --define generateBackupPoms=false versions:set
       - id: deploy-maven
         name: Deploy Maven Artifact
-        if: steps.commits.outputs.count > 0
         run: >
           mvn
           --batch-mode
           --activate-profiles release
@@ -77,12 +103,11 @@
           MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
       - id: create_release
         name: Create Release
-        if: steps.commits.outputs.count > 0
         uses: softprops/action-gh-release@v3
         with:
-          tag_name: ${{ steps.release.outputs.version }}
-          name: ${{ steps.release.outputs.version }}
+          tag_name: ${{ needs.prepare.outputs.version }}
+          name: ${{ needs.prepare.outputs.version }}
           token: ${{ secrets.GITHUB_TOKEN }}
           draft: false
           prerelease: false
-          generate_release_notes: true
+          body_path: ${{ steps.notes.outputs.file }}

.github/workflows/verify.yml

@@ -1,12 +1,28 @@
 # SPDX-FileCopyrightText: The devcontainer.java Authors
 # SPDX-License-Identifier: 0BSD
-
-name: Verify Commits
+name: Verify
 on:
   pull_request:
-    branches: [ main ]
+    branches: [main]
+permissions:
+  contents: read
 jobs:
-  verify:
+  github-actions:
+    name: github-actions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1
+        with:
+          fail_on_error: true
+          filter_mode: nofilter
+  reuse:
+    name: reuse
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6
+  mvn:
     runs-on: ubuntu-latest
     steps:
       - id: checkout
@@ -32,3 +48,17 @@ jobs:
       - id: verify
         name: Verify Project
         run: mvn --batch-mode --activate-profiles=native verify
+  verify:
+    # Single required check: mark only this one required in branch protection and
+    # new jobs are covered automatically.
+    name: Verify
+    needs: [github-actions, reuse, mvn]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify every job succeeded or skipped
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          bad=$(echo "$NEEDS" | jq -r 'to_entries[] | select(.value.result != "success" and .value.result != "skipped") | "\(.key)=\(.value.result)"')
+          [ -z "$bad" ] || { echo "::error::$bad"; exit 1; }

.gitignore

@@ -135,3 +135,5 @@ fabric.properties
 
 # Android studio 3.1+ serialized cache file
 .idea/caches/build_file_checksums.ser
+
+.claude/settings.local.json