Add draft GitHub release, X.Y.Z.N versions and Plugin Portal publishing

- release.yml opens a draft GitHub release on the tag with a runnable
  open-java-format-<version>-all.jar, the IntelliJ plugin zip, the Eclipse
  plugin jar and every native binary, each signed, plus a checksum file
- Releases accept X.Y.Z.N; the IntelliJ plugin compares such versions itself
  instead of through sls-versions, which is gone
- The Gradle plugins publish to the Gradle Plugin Portal by hand with
  `mise run release:gradle-plugin`, refusing anything but a release version

Author: abashev

.github/workflows/release.yml

@@ -1,14 +1,18 @@
 name: Release
 
 # Tags only, and the tag is the version: the build reads it from GITHUB_REF_NAME and jreleaserDeploy
-# refuses anything that is not a clean X.Y.Z.
+# refuses anything that is not a clean X.Y.Z or X.Y.Z.N.
 #
 # Two deployments per tag, because a published groupId:artifactId:version can never gain files
 # afterwards: the jars go up as one, and every platform's native binary as another. Both are uploaded
 # and validated only — the Portal holds them until someone presses publish.
 #
+# After both, a draft GitHub release on the tag collects the runnable jar, the IDE plugins and the native
+# binaries.
+#
 # Needs four repository secrets: JRELEASER_MAVENCENTRAL_USERNAME and JRELEASER_MAVENCENTRAL_PASSWORD
-# (the Central Portal user token) plus JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE.
+# (the Central Portal user token) plus JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE. The draft
+# release uses the workflow's own GITHUB_TOKEN.
 on:
   push:
     tags:
@@ -140,3 +144,47 @@ jobs:
           path: build/jreleaser/trace.log
           if-no-files-found: ignore
           retention-days: 7
+
+  # What Maven Central does not carry — the runnable formatter jar, the IntelliJ plugin zip, the Eclipse
+  # plugin jar, and every platform's native binary as a plain download — goes into a draft GitHub release
+  # on the tag, each file signed with the release key. Only once both deployments are in; publishing the
+  # draft is a click on GitHub, and a re-run fails while a release for the tag exists.
+  github-release:
+    name: draft GitHub release
+    needs: [jars, native-deploy]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install JDK 21
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Collect every platform's binary
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: native-images
+          pattern: native-image-*
+          merge-multiple: true
+
+      - name: Build the IDE plugins and open the draft release
+        run: ./gradlew -PreleaseTarget=github -PnativeImages=native-images jreleaserRelease
+        env:
+          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
+          JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
+
+      - name: Keep JReleaser's log
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jreleaser-log-github
+          path: build/jreleaser/trace.log
+          if-no-files-found: ignore
+          retention-days: 7

README.md

@@ -119,7 +119,7 @@ replaced with something a stranger can run.
 | Concern | Today | Replacement |
 |---|---|---|
 | CI | ~~CircleCI (`.circleci/config.yml`, generated by Palantir's Excavator)~~ | **Done** — [`.github/workflows/ci.yml`](.github/workflows/ci.yml), one explicit job per platform |
-| Release | ~~Palantir Autorelease + `com.palantir.gradle.externalpublish`~~ | **In progress** — JReleaser → Maven Central Portal, configured as [`buildSrc`](buildSrc/src/main/groovy) conventions and triggered by a tag ([`release.yml`](.github/workflows/release.yml)): one deployment for the jars, one for the native images of every platform. Uploads only for now — each deployment waits in the Portal until someone publishes it. Still to do: the Gradle plugin and the IDE plugins, and signing keys in a protected GitHub environment |
+| Release | ~~Palantir Autorelease + `com.palantir.gradle.externalpublish`~~ | **In progress** — JReleaser → Maven Central Portal, configured as [`buildSrc`](buildSrc/src/main/groovy) conventions and triggered by a tag ([`release.yml`](.github/workflows/release.yml)): one deployment for the jars, one for the native images of every platform. Uploads only for now — each deployment waits in the Portal until someone publishes it. The same tag opens a draft GitHub release with a runnable formatter jar (`java -jar`, no flags), the IntelliJ plugin zip, the Eclipse plugin jar and the native binaries, each file signed. The Gradle plugins go to the Gradle Plugin Portal by hand, with `mise run release:gradle-plugin`, once those jars are published. Still to do: the JetBrains Marketplace, and signing keys in a protected GitHub environment |
 | Dependency updates | Excavator (`.excavator.yml`) | Renovate |
 | Auto-merge | Bulldozer (`.bulldozer.yml`) | GitHub merge queue + auto-merge |
 | Changelog | Palantir changelog-app (`.changelog.yml`) | Release Drafter, changelog entry in the PR template |

build.gradle

@@ -7,7 +7,7 @@ buildscript {
 
     dependencies {
         classpath 'com.palantir.jakartapackagealignment:jakarta-package-alignment:0.7.0'
-        classpath 'com.gradle.publish:plugin-publish-plugin:2.1.1'
+        classpath 'com.gradle.publish:plugin-publish-plugin:2.2.1'
         classpath 'com.palantir.baseline-error-prone:gradle-baseline-error-prone:0.7.0'
         classpath 'com.palantir.baseline:gradle-baseline-java:7.9.0'
         classpath 'com.palantir.gradle.failure-reports:gradle-failure-reports:1.21.0'

buildSrc/src/main/groovy/open-java-format.release-conventions.gradle

@@ -10,8 +10,13 @@ plugins {
 // jobs, long after the jars are staged. `-PreleaseTarget=native` deploys the binaries those jobs
 // collected, the default deploys the jars; on a tag both read the same version from it.
 //
-// Not released yet: gradle-open-java-format, whose plugin markers and Gradle Plugin Portal listing are
-// a decision of their own. The Eclipse and IntelliJ plugins have no Maven publications at all.
+// `-PreleaseTarget=github` deploys nothing. It is for `jreleaserRelease`, which opens a draft GitHub
+// release on the tag with what Maven Central does not carry — the runnable formatter jar, the IntelliJ
+// plugin zip, the Eclipse plugin jar and every platform's native binary as a plain download — each file
+// signed, plus a checksum file.
+//
+// gradle-open-java-format is not released here: its plugins go to the Gradle Plugin Portal by hand, with
+// `mise run release:gradle-plugin`, once the jars they depend on are published.
 def releaseTarget = providers.gradleProperty('releaseTarget').getOrElse('jars')
 def releasedProjects
 if (releaseTarget == 'jars') {
@@ -22,13 +27,32 @@ if (releaseTarget == 'jars') {
     ]
 } else if (releaseTarget == 'native') {
     releasedProjects = [':open-java-format-native']
+} else if (releaseTarget == 'github') {
+    releasedProjects = []
 } else {
-    throw new GradleException("Unknown -PreleaseTarget=${releaseTarget}: use 'jars' or 'native'")
+    throw new GradleException("Unknown -PreleaseTarget=${releaseTarget}: use 'jars', 'native' or 'github'")
 }
 def stagingRepositories = releasedProjects.collect { path ->
     relativePath(project(path).layout.buildDirectory.dir('staging-deploy'))
 }
 
+// The GitHub release takes the binaries the per-platform jobs collected from -PnativeImages=<dir>, exactly
+// as the native deployment does.
+def nativeBinaries = []
+if (releaseTarget == 'github') {
+    def collectedNativeImages = providers.gradleProperty('nativeImages').getOrNull()
+    if (collectedNativeImages == null) {
+        throw new GradleException('-PreleaseTarget=github needs -PnativeImages=<dir> holding the native binaries')
+    }
+    nativeBinaries = fileTree(file(collectedNativeImages)) {
+        include 'open-java-format-*'
+        exclude '**/*.txt'
+    }.files.sort { it.name }
+    if (nativeBinaries.isEmpty()) {
+        throw new GradleException("No native images to release in ${collectedNativeImages}")
+    }
+}
+
 jreleaser {
     dependsOnAssemble = false
 
@@ -50,7 +74,38 @@ jreleaser {
 
     release {
         github {
-            enabled = false
+            enabled = releaseTarget == 'github'
+            // The tag is pushed by hand and is the version; the release only attaches to it.
+            skipTag = true
+            tagName = '{{projectVersion}}'
+            releaseName = '{{projectVersion}}'
+            // Published by hand after a look, like the deployments waiting in the Portal.
+            draft = true
+            changelog {
+                formatted = 'ALWAYS'
+                format = '- {{commitShortHash}} {{commitTitle}}'
+            }
+        }
+    }
+
+    // Name templates, not Gradle's version: the root project sets its version only after applying this
+    // plugin. The jars and the zip are built by the tasks jreleaserRelease depends on below.
+    files {
+        nativeBinaries.each { binary ->
+            artifact {
+                path = binary.absolutePath
+            }
+        }
+        if (releaseTarget == 'github') {
+            artifact {
+                path = 'open-java-format/build/libs/open-java-format-{{projectVersion}}-all.jar'
+            }
+            artifact {
+                path = 'open-java-format-idea-plugin/build/distributions/open-java-format-idea-plugin-{{projectVersion}}.zip'
+            }
+            artifact {
+                path = 'open-java-format-eclipse-plugin/build/libs/open-java-format-eclipse-plugin-{{projectVersion}}.jar'
+            }
         }
     }
 
@@ -71,7 +126,8 @@ jreleaser {
                 // The deployer's name selects its credentials — the Central Portal user token, as
                 // JRELEASER_DEPLOY_MAVEN_MAVENCENTRAL_SONATYPE_USERNAME and _PASSWORD.
                 sonatype {
-                    active = 'ALWAYS'
+                    // Nothing is deployed when the target is the GitHub release.
+                    active = releaseTarget == 'github' ? 'NEVER' : 'ALWAYS'
                     url = 'https://central.sonatype.com/api/v1/publisher'
                     namespace = 'dev.openjavaformat'
                     applyMavenCentralRules = true
@@ -86,18 +142,31 @@ jreleaser {
     }
 }
 
-// A release cannot be taken back, and the version comes from `git describe`: anywhere but a clean
-// checkout of a release tag it reads like 2.97.0-41-gf6667a2d.dirty. Refuse to upload that.
-def releaseVersion = provider { version.toString() }
-
 tasks.named('jreleaserDeploy') {
     releasedProjects.each { path ->
         dependsOn "${path}:publishAllPublicationsToStagingRepository"
     }
-    doFirst {
-        if (!dryrun.getOrElse(false) && !(releaseVersion.get() ==~ /\d+\.\d+\.\d+/)) {
-            throw new GradleException("Refusing to release ${releaseVersion.get()}: check out a release tag on a "
-                    + 'clean working tree, or pass --dryrun to rehearse without uploading.')
+}
+
+tasks.named('jreleaserRelease') {
+    if (releaseTarget == 'github') {
+        dependsOn ':open-java-format:allJar', ':open-java-format-idea-plugin:buildPlugin',
+                ':open-java-format-eclipse-plugin:jar'
+    }
+}
+
+// A release cannot be taken back, and the version comes from `git describe`: anywhere but a clean
+// checkout of a release tag it reads like 2.97.0-41-gf6667a2d.dirty. Refuse to upload that. A release is
+// upstream's X.Y.Z, optionally with a build number of our own after it: 2.98.0.1.
+def releaseVersion = provider { version.toString() }
+
+['jreleaserDeploy', 'jreleaserRelease'].each { taskName ->
+    tasks.named(taskName) {
+        doFirst {
+            if (!dryrun.getOrElse(false) && !(releaseVersion.get() ==~ /\d+\.\d+\.\d+(\.\d+)?/)) {
+                throw new GradleException("Refusing to release ${releaseVersion.get()}: check out a release tag on a "
+                        + 'clean working tree, or pass --dryrun to rehearse without uploading.')
+            }
         }
     }
 }

gradle-open-java-format/build.gradle

@@ -1,4 +1,6 @@
-apply plugin: 'java-gradle-plugin'
+// For the Gradle Plugin Portal: publishPlugins, run by hand once the version's jars are published on Maven
+// Central — the plugin depends on them. It applies java-gradle-plugin and maven-publish itself.
+apply plugin: 'com.gradle.plugin-publish'
 apply plugin: 'groovy'
 apply plugin: 'open-java-format.publishing-conventions'
 
@@ -156,3 +158,15 @@ tasks.named("test").configure {
         exclude '**/FormatDiffTest.class'
     }
 }
+
+// The Portal never takes a version back, so only a release version goes up — X.Y.Z or X.Y.Z.N, as for Maven
+// Central in open-java-format.release-conventions. --validate-only checks the metadata of any version.
+def portalVersion = provider { project.version.toString() }
+tasks.named('publishPlugins') {
+    doFirst {
+        if (!validateOnly.getOrElse(false) && !(portalVersion.get() ==~ /\d+\.\d+\.\d+(\.\d+)?/)) {
+            throw new GradleException("Refusing to publish ${portalVersion.get()} to the Gradle Plugin Portal: check "
+                    + 'out a release tag on a clean working tree, or pass --validate-only.')
+        }
+    }
+}

gradle/libs.versions.toml

@@ -40,5 +40,4 @@ junit-jupiter-migrationsupport = { module = "org.junit.jupiter:junit-jupiter-mig
 junit-platform-launcher = { module = "org.junit.platform:junit-platform-launcher", version = "6.1.3" }
 junit-vintage-engine = { module = "org.junit.vintage:junit-vintage-engine", version = "6.1.3" }
 palantir-platform = { module = "com.palantir.gradle.utils:platform", version = "0.29.0" }
-slsVersions = { module = "com.palantir.sls.versions:sls-versions", version = "1.18.0" }
 spotless-gradlePlugin = { module = "com.diffplug.spotless:spotless-plugin-gradle", version = "8.10.2" }

mise.toml

@@ -14,12 +14,44 @@ run = "act push --dryrun"
 
 [tasks."ci:build"]
 description = "Run the linux jar+native build job locally in Docker (slow: downloads JDKs, runs all tests)"
-run = "act push --job build"
+run = "act push --job build --env JAVA_HOME=/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/21.0.12-101.0.LTS/arm64"
 
 [tasks."ci:native"]
 description = "Run the linux-aarch64 native job locally in Docker"
 run = "act push --job native --matrix platform:linux-aarch64"
 
+# ---- Releases ----
+# JReleaser stages, signs and uploads to the Maven Central Portal the modules listed in
+# buildSrc/src/main/groovy/open-java-format.release-conventions.gradle. The PGP key and the Portal
+# token come from JRELEASER_* variables or ~/.jreleaser/config.properties. Only a clean checkout of a
+# release tag is accepted. Run these through mise, not ./gradlew: JReleaser's POM check finds Java
+# through JAVA_HOME, which mise sets, and without it logs an error and carries on unchecked.
+#
+# These deploy the jars. The native images are a deployment of their own — one binary per platform,
+# built by four CI jobs and uploaded together by .github/workflows/release.yml on a tag, because a
+# published version can never gain files afterwards.
+
+[tasks.release]
+description = "Stage, sign, and upload the release to the Maven Central Portal (publishing is a click there)"
+run = "./gradlew clean jreleaserDeploy"
+
+[tasks."release:dry-run"]
+description = "Rehearse the release: stage, sign and check the artifacts, upload nothing"
+run = "./gradlew clean jreleaserDeploy --dryrun"
+
+# The Gradle plugins go to the Gradle Plugin Portal instead, by hand and last: they depend on the version's
+# jars, so publish only once that deployment is live on Maven Central. The key and secret are
+# gradle.publish.key and gradle.publish.secret in ~/.gradle/gradle.properties. The Portal never takes a
+# version back; publishPlugins refuses anything but a release tag's version.
+
+[tasks."release:gradle-plugin"]
+description = "Publish the Gradle plugins to the Gradle Plugin Portal (once the jars are live on Maven Central)"
+run = "./gradlew :gradle-open-java-format:publishPlugins"
+
+[tasks."release:gradle-plugin:validate"]
+description = "Check the Gradle plugins' Portal metadata, publish nothing"
+run = "./gradlew :gradle-open-java-format:publishPlugins --validate-only"
+
 # ---- GitHub Actions secrets ----
 # Read from 1Password at apply time; nothing secret is stored in the repo. Requires gh
 # (authenticated with admin on this repository) and the 1Password CLI (`op signin` first).

open-java-format-idea-plugin/build.gradle

@@ -65,10 +65,6 @@ dependencies {
 
     implementation project(':open-java-format-jdk-bootstrap')
     implementation libs.caffeine
-    implementation(libs.slsVersions) {
-        // Has class version conflicts with slf4j brought in by Intellij
-        exclude group: 'org.slf4j', module: 'slf4j-api'
-    }
     implementation libs.palantir.platform
 
     formatter project(':open-java-format')

open-java-format-idea-plugin/src/main/java/com/palantir/javaformat/intellij/FormatterVersion.java

@@ -0,0 +1,71 @@
+/*
+ * (c) Copyright 2026 Palantir Technologies Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.palantir.javaformat.intellij;
+
+import java.util.Arrays;
+import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * A formatter version as this project writes them: dot-separated numbers — upstream's X.Y.Z, or 2.98.0.1 with a build
+ * number of our own — optionally followed by what {@code git describe} adds after a tag, such as {@code -3-gabc1234},
+ * and {@code .dirty}. Numbers compare numerically with a missing one counting as zero; commits after the tag only break
+ * a tie.
+ */
+final class FormatterVersion implements Comparable<FormatterVersion> {
+    private static final Pattern VERSION = Pattern.compile("(\\d+(?:\\.\\d+)*)(?:-(\\d+)-g\\p{XDigit}+)?(?:\\.dirty)?");
+
+    private final int[] numbers;
+    private final int commitsAfterTag;
+
+    private FormatterVersion(int[] numbers, int commitsAfterTag) {
+        this.numbers = numbers;
+        this.commitsAfterTag = commitsAfterTag;
+    }
+
+    static Optional<FormatterVersion> parse(String version) {
+        Matcher matcher = VERSION.matcher(version);
+        if (!matcher.matches()) {
+            return Optional.empty();
+        }
+        try {
+            int[] numbers = Arrays.stream(matcher.group(1).split("\\."))
+                    .mapToInt(Integer::parseInt)
+                    .toArray();
+            int commitsAfterTag = matcher.group(2) == null ? 0 : Integer.parseInt(matcher.group(2));
+            return Optional.of(new FormatterVersion(numbers, commitsAfterTag));
+        } catch (NumberFormatException e) {
+            return Optional.empty();
+        }
+    }
+
+    @Override
+    public int compareTo(FormatterVersion other) {
+        for (int i = 0; i < Math.max(numbers.length, other.numbers.length); i++) {
+            int difference = Integer.compare(numberAt(i), other.numberAt(i));
+            if (difference != 0) {
+                return difference;
+            }
+        }
+        return Integer.compare(commitsAfterTag, other.commitsAfterTag);
+    }
+
+    private int numberAt(int index) {
+        return index < numbers.length ? numbers[index] : 0;
+    }
+}