[jonathan-kosgei]

Summary

• Add a release job to ci.yml that runs after test on every push to the default branch, reads the version from pom.xml and, when tag v<version> does not exist yet, creates the tag and the GitHub release and publishes to Maven Central in the same run.
• Make release.yml callable (workflow_call with a tag input) while keeping its v* tag push trigger, so a tag pushed by hand still publishes as before. The deploy step and the secrets it uses are unchanged.
• Add a "Releasing" section to the README.

How it works

1. test runs as today for pull requests and pushes.
2. release (needs: test; push to the default branch only; permissions: contents: write; serialized through the release concurrency group) reads the project version from pom.xml with awk, derives v<version> and checks it with git ls-remote --exit-code --tags origin refs/tags/<tag>. When the tag is missing it runs gh release create <tag> --target $GITHUB_SHA --title <tag> --generate-notes with the workflow token and sets the job outputs tag and created=true; when the tag exists it says so and sets created=false.
3. publish (needs: release, only when created == 'true') calls release.yml with tag and secrets: inherit. A tag created with the workflow token does not trigger other workflows, so the Maven Central deploy has to run inside the same run.
4. release.yml checks out refs/tags/<tag>, taking the tag from the input or, on the tag push trigger, from github.ref_name, and runs the unchanged mvn deploy -DskipTests=true.

Verification

• python3 -c 'import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]' .github/workflows/*.yml passes and actionlint v1.7.12 reports no findings for either workflow.
• The version command prints 0.3.0 against the current pom.xml; git ls-remote --exit-code --tags origin refs/tags/v0.3.0 exits 2 (missing) and refs/tags/v0.2.2 exits 0 (present), so a merge of the current version would create v0.3.0.
• The two run scripts of the release job were executed locally under bash -e with a stub gh: they write version=0.3.0 and tag=v0.3.0, then created=true for the missing tag and created=false for the existing one.
• Only files under .github/ and the README change; the build and tests are untouched.
• The push-triggered release and publish jobs can only run after this is merged; the pull request CI on this branch exercises the test job.

🤖 Generated with Claude Code