ci: add publish-java + switch publish-python to token auth

publish-java.yml: tag-triggered (java-v*) Maven Central deploy of the
com.metaobjects:* reactor (Java + Kotlin), signed with the GPG key, mirroring
the manual 'mvn -Prelease deploy'. Uses the central-publishing plugin's
autoPublish + waitUntil=published, so a green run means live on Central.

publish-python.yml: use PYPI_API_TOKEN (the pypi.org trusted publisher is
unconfigured; the token works today), keeping the OIDC switch documented.

All required secrets are set in the repo (NPM_TOKEN, MAVEN_CENTRAL_USERNAME/
PASSWORD, GPG_PRIVATE_KEY, MAVEN_GPG_PASSPHRASE, PYPI_API_TOKEN), so every port
now auto-publishes on its tag like C#/NuGet.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LuZWKnWzYGVnESijL7uuky

Author: dmealing

.github/workflows/publish-java.yml

@@ -0,0 +1,68 @@
+name: publish-java
+
+# Publishes the com.metaobjects:* modules (Java AND Kotlin — they share the
+# server/java Maven reactor) to Maven Central via the Sonatype Central Portal,
+# signed with the maintainer's GPG key. Mirrors publish-csharp.yml: tag-triggered
+# or manual. This is the CI equivalent of the documented manual
+# `mvn -Prelease deploy` from server/java (docs/RELEASING.md).
+#
+# Publishes the versions already in the parent + module poms at the tagged commit
+# (the `7.x` line) — bump them first, commit, then tag. The central-publishing
+# plugin runs with <autoPublish>true</autoPublish> + <waitUntil>published</waitUntil>,
+# so a green run means the artifacts are live on Central (no manual staging
+# promotion). Maven Central versions are immutable.
+#
+# One-time setup (repo Settings -> Secrets and variables -> Actions) — ALREADY SET:
+#   MAVEN_CENTRAL_USERNAME / MAVEN_CENTRAL_PASSWORD = the Central Portal token pair
+#     (the `central` server in the maintainer's ~/.m2/settings.xml).
+#   GPG_PRIVATE_KEY = ASCII-armored secret key (`gpg --armor --export-secret-keys`).
+#   MAVEN_GPG_PASSPHRASE = the key's passphrase (empty here — the signing key is
+#     passphraseless; the empty secret is intentional).
+#
+# Triggers: a `java-v*` tag (e.g. `java-v7.4.3`), or manual workflow_dispatch.
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'java-v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21 + Maven settings (Central server + GPG import)
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+          # Writes ~/.m2/settings.xml with a `central` server whose creds come from
+          # the env vars below, and imports the GPG key for maven-gpg-plugin.
+          server-id: central
+          server-username: MAVEN_CENTRAL_USERNAME
+          server-password: MAVEN_CENTRAL_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase: MAVEN_GPG_PASSPHRASE
+
+      - name: Allow non-interactive (loopback) GPG signing
+        run: |
+          # maven-gpg-plugin 3.x signs via the agent; in CI it must use loopback
+          # pinentry. The signing key is passphraseless, so an empty passphrase
+          # plus loopback signs without a prompt.
+          mkdir -p ~/.gnupg
+          echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
+          echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
+          gpg-connect-agent reloadagent /bye || true
+
+      - name: Deploy to Maven Central (signed, auto-published)
+        working-directory: server/java
+        env:
+          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+        # Tests run on every PR via the conformance workflow; the release tag is cut
+        # from already-green main, so the publish build skips them (it still builds
+        # + signs + attaches the javadoc/sources jars Central requires via -Prelease).
+        run: mvn -B -Prelease deploy -DskipTests -Dgpg.passphrase="${MAVEN_GPG_PASSPHRASE}"

.github/workflows/publish-python.yml

@@ -1,18 +1,20 @@
 name: publish-python
 
-# Publishes the `metaobjects` Python package to PyPI via Trusted Publishing (OIDC) —
-# no API token. PyPI mints short-lived credentials after validating GitHub's OIDC
-# token against the trusted publisher configured for the project. See docs/RELEASING.md.
+# Publishes the `metaobjects` Python package to PyPI using an API token.
+# Mirrors publish-csharp.yml / publish-npm.yml: tag-triggered or manual.
 #
-# One-time setup on PyPI (project `metaobjects` -> Settings -> Publishing ->
-# Add a new GitHub publisher):
-#   Owner:        metaobjectsdev
-#   Repository:   metaobjects
-#   Workflow:     publish-python.yml
-#   Environment:  (leave empty unless you uncomment `environment:` below)
-# Once that's added you can DELETE any long-lived PyPI API token.
+# We use a token (not OIDC Trusted Publishing) because the pypi.org trusted
+# publisher for this project isn't configured — the token works today. To switch
+# to OIDC later: add a GitHub publisher on PyPI (Owner `metaobjectsdev`, Repo
+# `metaobjects`, Workflow `publish-python.yml`), then drop `password:` below and
+# add `permissions: id-token: write`.
 #
-# Triggers: manual (workflow_dispatch) or a python-v* tag.
+# One-time setup (repo Settings -> Secrets and variables -> Actions) — ALREADY SET:
+#   PYPI_API_TOKEN = a PyPI API token (pypi-...) with upload rights to `metaobjects`.
+#
+# PyPI versions are immutable — bump server/python's version, commit, then tag.
+#
+# Triggers: a `python-v*` tag (e.g. `python-v0.12.1`), or manual workflow_dispatch.
 
 on:
   workflow_dispatch:
@@ -23,12 +25,6 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
-    # If you scope the PyPI trusted publisher to a GitHub environment, create it in
-    # repo Settings and uncomment (must match the publisher's Environment exactly):
-    # environment: release
-    permissions:
-      id-token: write   # required: lets this job mint a GitHub OIDC token for PyPI
-      contents: read
     steps:
       - uses: actions/checkout@v4
 
@@ -39,7 +35,8 @@ jobs:
         working-directory: server/python
         run: uv build --out-dir dist
 
-      - name: Publish to PyPI (Trusted Publishing)
+      - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: server/python/dist
+          password: ${{ secrets.PYPI_API_TOKEN }}