Releasing Nomos

Prepare the version

1. Update the reactor, example, README, and changelog to one non-SNAPSHOT version. The site pages pick the version up automatically from the placeholder, and the API reference is generated when the site is built.
2. Merge the focused release pull request after Java 11/17 CI and CodeQL pass.

Publish the GitHub Release

1. Create a tag exactly equal to the Maven project version, without a v prefix.
2. Review release notes and mark prerelease versions appropriately.
3. Publish the GitHub Release. This is the intentional release approval.

The protected Maven Central workflow checks the tag/version pair, credential expiration, signing-key fingerprint, and duplicate-version status. It then runs the reactor and example, signs every Central artifact, publishes only after Central validation succeeds, waits for the published state, and tests a clean consumer.

Safe defaults

A local mvn deploy uses user-managed Central deployment by default and stops after validation. Only the protected GitHub Release workflow enables automatic publication.

Failure handling

• A build, test, signing, upload, or Central validation failure publishes nothing.
• A version already present on Central fails before deployment.
• A published Central version is immutable; corrections require a new version.
• Rotate the Central token and PGP key before the expiration dates recorded in the maven-central environment.