From ea1220765f05c3fbd8cfeed834fc6d20c54994a2 Mon Sep 17 00:00:00 2001
From: Oliver Wolff <23139298+cuioss@users.noreply.github.com>
Date: Thu, 24 Sep 2026 10:52:21 +0200
Subject: [PATCH 1/2] ci(release): never release the template itself, guard the
 trigger

- the template repository is excluded from releasing; derived repositories
  are unaffected (the literal stays unchanged there)
- base filter branches: [main], dispatch confined to main
- drop PAGES_DEPLOY_TOKEN: reusable-maven-release v0.30.0 does not declare
  it, so every run ended in startup_failure
- header explains that merging a current-version change IS a release

Must merge on its own, before any change of release.current-version.

Co-Authored-By: plan-marshall <noreply@cuioss.de>
---
 .github/workflows/release.yml | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c37368..56e9f0c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,20 +1,37 @@
-# Example: Copy this to your repo as .github/workflows/release.yml
 # Configuration is read from .github/project.yml - no inputs needed!
+#
+# MERGING A CHANGE OF release.current-version IN .github/project.yml IS A RELEASE.
+# The central guard inside reusable-maven-release.yml publishes to Maven Central whenever
+# current-version differs from the merge commit's first parent and is untagged. Every other
+# project.yml edit reaches this workflow too (paths: is only a prefilter) and is refused there.
+# plan-marshall-mcp 0.1.0 was published by accident exactly this way: its bootstrap PR moved the
+# template's current-version while customizing. Change current-version only through the release
+# runbook (.claude/skills/release/SKILL.md).
 name: Release
 
 on:
+  workflow_dispatch:
+  # PREFILTER ONLY, NEVER THE DECISION. `branches:` is the PR's base: only merges into main may ask.
   pull_request:
     types: [closed]
-    paths:
-      - '.github/project.yml'
-  workflow_dispatch:
+    branches: [main]
+    paths: ['.github/project.yml']
 
 permissions:
   contents: read
 
 jobs:
   release:
-    if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
+    # ANDed with the central guard, never an alternative to it:
+    # 1. The template repository itself never releases. Repositories created from it carry this
+    #    line unchanged and are unaffected. customize.sh deliberately does NOT rewrite this file:
+    #    renaming the literal below to the new repository would disable its releases.
+    # 2. A dispatch (which takes no branch filter) runs from main only.
+    # 3. A PR closed without merging never releases.
+    if: >-
+      github.repository != 'cuioss/cui-java-module-template' &&
+      (github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main') &&
+      (github.event_name != 'pull_request' || github.event.pull_request.merged == true)
     permissions:
       contents: write
     uses: cuioss/cuioss-organization/.github/workflows/reusable-maven-release.yml@2fa5476de3435e7fc3705646c3f1f3c99be95e71 # v0.30.0
@@ -25,4 +42,3 @@ jobs:
       OSS_SONATYPE_PASSWORD: ${{ secrets.OSS_SONATYPE_PASSWORD }}
       GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
       GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      PAGES_DEPLOY_TOKEN: ${{ secrets.PAGES_DEPLOY_TOKEN }}

From a6af3cc77137e32b99c8ca8ca5c44964e17fa173 Mon Sep 17 00:00:00 2001
From: Oliver Wolff <23139298+cuioss@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:11:49 +0200
Subject: [PATCH 2/2] ci(release): state that workflow_dispatch bypasses the
 guard

Co-Authored-By: plan-marshall <noreply@cuioss.de>
---
 .github/workflows/release.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 56e9f0c..7d8c1c0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,10 @@
 # plan-marshall-mcp 0.1.0 was published by accident exactly this way: its bootstrap PR moved the
 # template's current-version while customizing. Change current-version only through the release
 # runbook (.claude/skills/release/SKILL.md).
+#
+# workflow_dispatch is NOT guarded: the central guard proceeds unconditionally on a dispatch, including
+# an unchanged or already-tagged version. It is the deliberate fallback path (and the path of a derived
+# repository's first release); the runbook's pre-cut checks are the only gate there.
 name: Release
 
 on: