Merge release workflow into publish workflow for atomic releases

Author: kwent

.github/workflows/publish.yml

@@ -9,10 +9,12 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write
       packages: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Set up JDK for Maven Central
         uses: actions/setup-java@v5
@@ -45,4 +47,49 @@ jobs:
       - name: Publish to GitHub Packages
         run: mvn --batch-mode deploy -DaltDeploymentRepository=github::default::https://maven.pkg.github.com/${{ github.repository }} -Dcentral.publishing.skip=true
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: Extract changelog for version
+        id: changelog
+        run: |
+          # Extract the section for this version from CHANGELOG.md
+          VERSION="${{ steps.version.outputs.version }}"
+
+          # Get changelog content between version headers
+          CHANGELOG=$(awk "/## \[$VERSION\]/,/## \[/" CHANGELOG.md | sed '1d;$d' | sed '/^$/d')
+
+          # If changelog extraction failed, use a default message
+          if [ -z "$CHANGELOG" ]; then
+            CHANGELOG="Release version $VERSION
+
+          See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/master/CHANGELOG.md) for details."
+          fi
+
+          # Save to output using heredoc to handle multiline content
+          {
+            echo 'notes<<EOF'
+            echo "$CHANGELOG"
+            echo EOF
+          } >> $GITHUB_OUTPUT
+
+      - name: Create GitHub Release
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const tag = context.ref.replace('refs/tags/', '');
+            const version = tag.replace('v', '');
+
+            await github.rest.repos.createRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              tag_name: tag,
+              name: `Release ${version}`,
+              body: `${{ steps.changelog.outputs.notes }}`,
+              draft: false,
+              prerelease: version.includes('-') || version.includes('alpha') || version.includes('beta') || version.includes('rc')
+            }); 

.github/workflows/release.yml

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.2] - 2026-01-22
+
+### Fixed
+- Fixed GPG key format in GitHub Actions (use ASCII armored format instead of base64)
+- Fixed GitHub Packages deployment by skipping Maven Central plugin during GitHub Packages publish
+
+### Changed
+- Merged release workflow into publish workflow for atomic releases
+- GitHub releases now only created after successful publishing to both registries
+- Updated publishing documentation with correct GPG key export instructions
+
 ## [0.0.1] - 2026-01-20
 
 ### Added

CHANGELOG.md

@@ -160,8 +160,7 @@ The project uses **Spotless** with **Google Java Format (AOSP style)**:
 GitHub Actions workflows:
 - **test.yml** - Runs tests on all branches using JDK 17
 - **maven.yml** - Maven-based build pipeline
-- **publish.yml** - Publishes artifacts to Maven Central and GitHub Packages (triggered on tag push)
-- **release.yml** - Creates GitHub releases with changelog notes (triggered on tag push)
+- **publish.yml** - Publishes artifacts to Maven Central and GitHub Packages, then creates GitHub release (triggered on tag push)
 
 ## Publishing & Releases
 
@@ -186,9 +185,12 @@ make push-tag
 
 **Automated workflow (triggered by `make push-tag`):**
 1. `make bump-patch` (or minor/major) - Updates version in both pom.xml and build.gradle, commits, and creates tag locally
-2. `make push-tag` - Pushes the tag to GitHub, which automatically triggers:
-   - **publish.yml** - Runs tests, signs artifacts, publishes to Maven Central and GitHub Packages
-   - **release.yml** - Creates GitHub release with changelog notes
+2. `make push-tag` - Pushes the tag to GitHub, which automatically triggers **publish.yml**:
+   - Runs tests
+   - Signs artifacts with GPG
+   - Publishes to Maven Central
+   - Publishes to GitHub Packages
+   - Creates GitHub release with changelog notes (only if all publishing succeeds)
 
 **One-command releases:**
 ```bash

CLAUDE.md

@@ -119,14 +119,18 @@ make release-minor   # 0.0.1 -> 0.1.0
 make release-major   # 0.0.1 -> 1.0.0
 ```
 
-### Step 3: Monitor the Workflows
+### Step 3: Monitor the Workflow
 
-Two workflows run automatically on tag push:
-- **publish.yml** - Publishes to Maven Central and GitHub Packages
-- **release.yml** - Creates GitHub release with changelog
+The **publish.yml** workflow runs automatically on tag push and performs these steps in order:
+1. Runs all tests
+2. Publishes to Maven Central (with GPG signing)
+3. Publishes to GitHub Packages
+4. Creates GitHub release with changelog notes (only if steps 1-3 succeed)
 
 Check the Actions tab: https://github.com/rootlyhq/rootly-java/actions
 
+**Important:** The GitHub release is only created after successful publishing to both registries, ensuring atomic releases.
+
 ### Step 4: Verify Publication
 
 **Maven Central** (available within 30 minutes):