From 93e00649b6e4bed61d309686aae8adbef6999c59 Mon Sep 17 00:00:00 2001
From: Grebennikov Roman <grv@dfdx.me>
Date: Mon, 7 Sep 2026 18:40:57 +0200
Subject: [PATCH] auto-release to sonatype within GHA

---
 .github/workflows/ci.yml      |  2 ++
 .github/workflows/release.yml | 61 +++++++++++++++++++++++++++++++++++
 build.sbt                     | 15 +++++++--
 project/plugins.sbt           |  1 +
 4 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b0ff96d..3a5ccd1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,8 @@ jobs:
     - uses: actions/checkout@v7
       with:
         lfs: true
+        fetch-depth: 0
+        fetch-tags: true
 
     - uses: actions/cache@v6
       with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..f4b3966
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,61 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+*' # 0.2.7, 0.2.7-M1, 0.2.7-RC1 — no v prefix
+
+permissions:
+  contents: write # create release + upload assets
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # sbt-dynver derives the version from `git describe`, which needs tags + history
+          fetch-depth: 0
+          fetch-tags: true
+          lfs: true
+
+      - uses: actions/cache@v6
+        with:
+          path: |
+            ~/.sbt
+            ~/.m2
+            ~/.ivy2
+            ~/.cache
+          key: ${{ runner.os }}-build-${{ hashFiles('build.sbt', 'project/**') }}
+
+      - uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: 21
+
+      - uses: sbt/setup-sbt@v1
+
+      - name: Import PGP key
+        run: echo "$PGP_SECRET" | gpg --batch --import
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+
+      - name: Verify version is derived from the tag
+        run: sbt --server -mem 3000 assertTagVersion
+
+      - name: Run tests
+        run: sbt --server -mem 3000 test
+
+      - name: Publish to Maven Central
+        run: sbt --server -mem 3000 publishSigned sonaRelease
+        env:
+          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v3
+        with:
+          generate_release_notes: true
+          prerelease: ${{ contains(github.ref_name, '-') }} # 0.2.7-M1 → pre-release
+          files: target/out/jvm/*/ltrlib/ltrlib_*-${{ github.ref_name }}.jar
diff --git a/build.sbt b/build.sbt
index 2c95ebf..78be8e7 100644
--- a/build.sbt
+++ b/build.sbt
@@ -1,8 +1,19 @@
 import Deps._
 
-name := "ltrlib"
+ThisBuild / dynverVTagPrefix := false
+ThisBuild / versionScheme    := Some("early-semver")
+
+ThisBuild / credentials ++= (for {
+  user <- sys.env.get("SONATYPE_USERNAME")
+  pass <- sys.env.get("SONATYPE_PASSWORD")
+} yield Credentials("Sonatype Central Portal", "central.sonatype.com", user, pass)).toList
 
-version := "0.2.6"
+lazy val assertTagVersion = taskKey[Unit]("assert that version is derived from an exact git tag")
+assertTagVersion := {
+  if (isSnapshot.value) sys.error(s"version ${version.value} is not an exact git tag version")
+}
+
+name := "ltrlib"
 
 scalaVersion := "3.9.0"
 
diff --git a/project/plugins.sbt b/project/plugins.sbt
index 5918676..7f0f6da 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -1,3 +1,4 @@
 addSbtPlugin("com.timushev.sbt" % "sbt-updates"  % "0.7.0")
 addSbtPlugin("com.github.sbt"   % "sbt-pgp"      % "2.3.2")
 addSbtPlugin("org.scalameta"    % "sbt-scalafmt" % "2.6.2")
+addSbtPlugin("com.github.sbt"   % "sbt-dynver"   % "5.1.1")