From e7b25d0c60339d5cb56c972ef71dc8cc7a22377a Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukasz.lenart@gmail.com>
Date: Wed, 1 Jul 2026 08:45:30 +0200
Subject: [PATCH] ci: prevent CI from deploying release versions unsigned

The Deploy SNAPSHOT job runs `mvn deploy` without GPG signing on every
push to release/6.0.x. When `release:prepare` pushes its
`[maven-release-plugin] prepare release X.Y.Z` commit, the POM version is
briefly the non-SNAPSHOT release version, so CI uploaded an unsigned
bundle to the Central Portal, which fails validation with
`Missing signature for file`.

- maven.yml: the deploy step now reads project.version and skips unless
  it ends in -SNAPSHOT, so a release-plugin commit can never trigger a
  release deploy.
- struts2-bootstrap-showcase/pom.xml: add skipPublishing=true to
  central-publishing-maven-plugin so the demo war is not published to
  Maven Central.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/maven.yml        | 6 ++++++
 struts2-bootstrap-showcase/pom.xml | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 66aa565..964866a 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -37,5 +37,11 @@ jobs:
     - name: Deploy SNAPSHOT
       if: github.ref == 'refs/heads/release/6.0.x' || github.ref == 'refs/heads/release/5.0.x'
       run: |
+        VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version)
+        if [[ "$VERSION" != *-SNAPSHOT ]]; then
+          echo "⏭️  Version $VERSION is not a SNAPSHOT (release-plugin commit) — skipping deploy"
+          exit 0
+        fi
+        echo "🚀 Deploying $VERSION"
         echo "${{ secrets.MAVEN_SETTINGS }}" > ~/.m2/settings-central.xml
         mvn -B -DskipTests=true deploy -s ~/.m2/settings-central.xml
diff --git a/struts2-bootstrap-showcase/pom.xml b/struts2-bootstrap-showcase/pom.xml
index 21d8fa7..533811d 100644
--- a/struts2-bootstrap-showcase/pom.xml
+++ b/struts2-bootstrap-showcase/pom.xml
@@ -29,6 +29,13 @@
                 <groupId>org.eclipse.jetty</groupId>
                 <artifactId>jetty-maven-plugin</artifactId>
             </plugin>
+            <plugin>
+                <groupId>org.sonatype.central</groupId>
+                <artifactId>central-publishing-maven-plugin</artifactId>
+                <configuration>
+                    <skipPublishing>true</skipPublishing>
+                </configuration>
+            </plugin>
         </plugins>
         <pluginManagement>
             <plugins>