Latent risks in release.yml, none currently failing but each one incident away:
publish-npm has no needs: publish (release.yml:67), so a failed Central deploy still publishes @storm-orm/cli pointing at artifacts that do not exist, and npm versions cannot be reused after unpublish.- The tag deploy runs
-DskipTests with no check that the tagged commit passed CI. A tag on an untested commit publishes irreversibly.
- Central publishing uses
waitUntil: uploaded (pom.xml:296), so publish-gradle-plugin (which needs the artifacts on Central) can run before Central validation completes. Consider waitUntil: published.
- The
publish job still uses actions/checkout@v3 / setup-java@v3 (deprecation annotations in the run log) while every other job is on v4. Its server-username/server-password inputs are given secret values where env var names are expected; it only works because ~/.m2/settings.xml is overwritten by hand at :37-52. CENTRAL_USER_TOKEN (:54) is never read. Delete the dead config.
- The README version sed (
:177) rewrites every <version>x.y.z</version> in the file. Correct today with one occurrence; silently wrong the moment a second XML snippet lands in the README. Anchor it to the storm-bom block.
Latent risks in
release.yml, none currently failing but each one incident away:publish-npmhas noneeds: publish(release.yml:67), so a failed Central deploy still publishes@storm-orm/clipointing at artifacts that do not exist, and npm versions cannot be reused after unpublish.-DskipTestswith no check that the tagged commit passed CI. A tag on an untested commit publishes irreversibly.waitUntil: uploaded(pom.xml:296), sopublish-gradle-plugin(which needs the artifacts on Central) can run before Central validation completes. ConsiderwaitUntil: published.publishjob still usesactions/checkout@v3/setup-java@v3(deprecation annotations in the run log) while every other job is on v4. Itsserver-username/server-passwordinputs are given secret values where env var names are expected; it only works because~/.m2/settings.xmlis overwritten by hand at:37-52.CENTRAL_USER_TOKEN(:54) is never read. Delete the dead config.:177) rewrites every<version>x.y.z</version>in the file. Correct today with one occurrence; silently wrong the moment a second XML snippet lands in the README. Anchor it to the storm-bom block.