github · SandraAhlgrimm · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
@@ -448,7 +448,7 @@ jobs:
       - name: Build Linux classifier and deploy complete snapshot
         run: |
           VERSION="${{ steps.windows-artifact.outputs.version }}"
-          mvn -B deploy -DskipTests -Dcopilot.native.libc=glibc \
+          mvn -B deploy -DskipTests -DskipITs -Dcopilot.native.libc=glibc \
             "-Dcopilot.native.external.linux.arm64.classifier.path=${{ steps.linux-arm64-artifact.outputs.linux_arm64_jar }}" \
             "-Dcopilot.native.external.win32.classifier.path=${{ steps.windows-artifact.outputs.windows_jar }}" \
             "-Dcopilot.native.external.win32.arm64.classifier.path=${{ steps.windows-arm64-artifact.outputs.windows_arm64_jar }}" \

@@ -8,6 +8,7 @@ permissions:
   contents: read
 
 env:
+  JAVA_PUBLICATION_REVISION: "0.0.0-ci"
   MAVEN_OPTS: >-
     -Daether.connector.http.retryHandler.count=3
     -Daether.connector.http.retryHandler.serviceUnavailable=429,502,503
@@ -107,9 +108,9 @@ jobs:
         id: build
         run: |
           set -euo pipefail
+          VERSION="$JAVA_PUBLICATION_REVISION"
           node copilot-native/scripts/validate-native-host.mjs linux-arm64
-          mvn -B -pl copilot-native package -DskipTests -Dcopilot.native.libc=glibc
-          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
+          mvn -B -pl copilot-native package -DskipTests -Dcopilot.native.libc=glibc "-Drevision=$VERSION"
           JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-linux-arm64.jar"
           PRIMARY_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION.jar"
           test -f "$JAR"
@@ -165,9 +166,9 @@ jobs:
       - name: Build and validate win32-x64 classifier
         id: build
         run: |
+          $version = $env:JAVA_PUBLICATION_REVISION
           node copilot-native/scripts/validate-native-host.mjs win32-x64
-          mvn -B -pl copilot-native package -DskipTests
-          $version = mvn help:evaluate "-Dexpression=project.version" -q "-DforceStdout"
+          mvn -B -pl copilot-native package -DskipTests "-Drevision=$version"
           $jar = "copilot-native/target/copilot-sdk-java-runtime-$version-win32-x64.jar"
           $primaryJar = "copilot-native/target/copilot-sdk-java-runtime-$version.jar"
           if (-not (Test-Path -LiteralPath $jar -PathType Leaf)) {
@@ -223,9 +224,9 @@ jobs:
       - name: Build and validate win32-arm64 classifier
         id: build
         run: |
+          $version = $env:JAVA_PUBLICATION_REVISION
           node copilot-native/scripts/validate-native-host.mjs win32-arm64
-          mvn -B -pl copilot-native package -DskipTests
-          $version = mvn help:evaluate "-Dexpression=project.version" -q "-DforceStdout"
+          mvn -B -pl copilot-native package -DskipTests "-Drevision=$version"
           $jar = "copilot-native/target/copilot-sdk-java-runtime-$version-win32-arm64.jar"
           $primaryJar = "copilot-native/target/copilot-sdk-java-runtime-$version.jar"
           if (-not (Test-Path -LiteralPath $jar -PathType Leaf)) {
@@ -282,9 +283,9 @@ jobs:
         id: build
         run: |
           set -euo pipefail
+          VERSION="$JAVA_PUBLICATION_REVISION"
           node copilot-native/scripts/validate-native-host.mjs darwin-arm64
-          mvn -B -pl copilot-native package -DskipTests
-          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
+          mvn -B -pl copilot-native package -DskipTests "-Drevision=$VERSION"
           JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION-darwin-arm64.jar"
           PRIMARY_JAR="copilot-native/target/copilot-sdk-java-runtime-$VERSION.jar"
           test -f "$JAR"
@@ -360,14 +361,15 @@ jobs:
           name: java-native-publication-darwin-arm64-${{ github.run_id }}
           path: ${{ github.workspace }}/java/native-publication-input/darwin
 
-      - name: Verify native inputs and deploy the complete local release
+      - name: Verify native inputs and install the complete local release
         run: |
           set -euo pipefail
           test "$(git rev-parse HEAD)" = "${{ needs.java-native-publication-linux-arm64.outputs.source_sha }}"
           test "$(git rev-parse HEAD)" = "${{ needs.java-native-publication-windows.outputs.source_sha }}"
           test "$(git rev-parse HEAD)" = "${{ needs.java-native-publication-windows-arm64.outputs.source_sha }}"
           test "$(git rev-parse HEAD)" = "${{ needs.java-native-publication-darwin.outputs.source_sha }}"
           VERSION="${{ needs.java-native-publication-windows.outputs.version }}"
+          test "$VERSION" = "$JAVA_PUBLICATION_REVISION"
           test "$VERSION" = "${{ needs.java-native-publication-linux-arm64.outputs.version }}"
           test "$VERSION" = "${{ needs.java-native-publication-windows-arm64.outputs.version }}"
           test "$VERSION" = "${{ needs.java-native-publication-darwin.outputs.version }}"
@@ -407,17 +409,21 @@ jobs:
             --quick-generate-key 'Copilot SDK local validation <local-validation@example.invalid>' rsa2048 sign 1d
           LOCAL_REPOSITORY="$GITHUB_WORKSPACE/java/copilot-native/target/local-publication-repository"
           rm -rf "$LOCAL_REPOSITORY"
-          mvn -B -pl copilot-native deploy -Prelease -DskipTests \
+          mvn -B -pl copilot-native install -Prelease -DskipTests \
+            "-Drevision=$VERSION" \
             -Dcopilot.native.libc=glibc \
-            -Dcopilot.native.test.local.publication=true \
-            -DskipPublishing=true \
             "-Dcopilot.native.external.linux.arm64.classifier.path=$LINUX_ARM64_JAR" \
             "-Dcopilot.native.external.win32.classifier.path=$WINDOWS_JAR" \
             "-Dcopilot.native.external.win32.arm64.classifier.path=$WINDOWS_ARM64_JAR" \
             "-Dcopilot.native.external.darwin.classifier.path=$DARWIN_JAR" \
             "-Dmaven.repo.local=$LOCAL_REPOSITORY"
           node copilot-native/scripts/validate-local-publication.mjs \
             "$LOCAL_REPOSITORY" copilot-sdk-java-runtime "$VERSION" .. --signatures
+          mvn -B -pl sdk install -Prelease -DskipTests -DskipITs \
+            "-Drevision=$VERSION" \
+            "-Dmaven.repo.local=$LOCAL_REPOSITORY"
+          node copilot-native/scripts/validate-local-publication.mjs \
+            "$LOCAL_REPOSITORY" copilot-sdk-java "$VERSION" .. --signatures
 
   java-sdk:
     name: "Java SDK Tests (JDK ${{ matrix.test-jdk }})"
@@ -451,6 +457,10 @@ jobs:
         if: matrix.test-jdk == '25'
         run: ./scripts/test-update-documentation-versions.sh
 
+      - name: Test release source validation
+        if: matrix.test-jdk == '25'
+        run: node --test scripts/resolve-release-source.test.mjs
+
       - name: Build SDK and set up test harness
         run: mvn test-compile jar:jar
 

@@ -33,7 +33,7 @@ jobs:
         id: setup-copilot
 
       - name: Build SDK and install to local repo
-        run: mvn -DskipTests -Pskip-test-harness clean install
+        run: mvn -DskipTests -DskipITs -Pskip-test-harness clean install
 
       - name: Create and run smoke test via Copilot CLI
         env:
@@ -88,7 +88,7 @@ jobs:
         id: setup-copilot
 
       - name: Build SDK and install to local repo
-        run: mvn -DskipTests -Pskip-test-harness clean install
+        run: mvn -DskipTests -DskipITs -Pskip-test-harness clean install
 
       - name: Create and run smoke test via Copilot CLI
         env:

@@ -383,11 +383,11 @@ jobs:
     if: github.event.inputs.dist-tag != 'unstable' && github.ref == 'refs/heads/main'
     needs: version
     permissions:
-      contents: write
-      id-token: write
+      contents: read
     uses: ./.github/workflows/java-publish-maven.yml
     with:
       releaseVersion: ${{ needs.version.outputs.version }}
+      sourceSha: ${{ github.sha }}
       prerelease: ${{ github.event.inputs.dist-tag == 'prerelease' }}
     secrets: inherit
 
@@ -485,3 +485,58 @@ jobs:
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Tag Java SDK
+        # Reuse a tag only when it identifies the source that was published.
+        if: github.event.inputs.dist-tag == 'latest' || github.event.inputs.dist-tag == 'prerelease'
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git fetch --tags origin
+          TAG_NAME="java/v${VERSION}"
+          if git show-ref --verify --quiet "refs/tags/$TAG_NAME"; then
+            TAG_COMMIT=$(git rev-parse --verify "refs/tags/${TAG_NAME}^{commit}")
+            if [ "$TAG_COMMIT" != "$SOURCE_SHA" ]; then
+              echo "::error::Tag $TAG_NAME points to $TAG_COMMIT, expected $SOURCE_SHA. Refusing to overwrite it."
+              exit 1
+            fi
+            echo "Tag $TAG_NAME already points to the release source, skipping tag push"
+          else
+            STATUS=$?
+            if [ "$STATUS" -ne 1 ]; then
+              echo "::error::Could not inspect tag $TAG_NAME."
+              exit "$STATUS"
+            fi
+            git tag "$TAG_NAME" "$SOURCE_SHA"
+            git push origin "refs/tags/$TAG_NAME"
+            echo "Created and pushed tag $TAG_NAME"
+          fi
+        env:
+          VERSION: ${{ needs.version.outputs.version }}
+          SOURCE_SHA: ${{ github.sha }}
+
+  deploy-java-site:
+    name: Deploy Java documentation site
+    needs: [version, github-release]
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Trigger Java documentation site deploy
+        # A failed dispatch can be retried without recreating the GitHub release.
+        run: |
+          set -euo pipefail
+          TAG="java/v${VERSION}"
+          PUBLISH_AS_LATEST=true
+          if [ "$DIST_TAG" = "prerelease" ]; then
+            PUBLISH_AS_LATEST=false
+          fi
+          echo "Triggering site deployment for version ${VERSION} (tag: ${TAG})"
+          gh workflow run deploy-site.yml \
+            --repo github/copilot-sdk-java \
+            -f version="${VERSION}" \
+            -f publish_as_latest="${PUBLISH_AS_LATEST}" \
+            -f monorepo_tag="${TAG}"
+        env:
+          VERSION: ${{ needs.version.outputs.version }}
+          DIST_TAG: ${{ github.event.inputs.dist-tag }}
+          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_GITHUB_TOKEN }}
@@ -71,7 +71,7 @@ jobs:
               - '!**/.editorconfig'
               - '!**/*.{png,jpg,jpeg,gif,svg}'
             java:
-              - '{java/**,test/**,nodejs/package.json,nodejs/scripts/**,.github/workflows/java-sdk-tests.yml,.github/actions/setup-copilot/**,.github/actions/java-test-report/**}'
+              - '{java/**,test/**,nodejs/package.json,nodejs/scripts/**,.github/workflows/java-sdk-tests.yml,.github/workflows/java-publish-maven.yml,.github/workflows/java-publish-snapshot.yml,.github/workflows/java-smoke-test.yml,.github/workflows/java-codegen-check.yml,.github/workflows/publish.yml,.github/actions/setup-copilot/**,.github/actions/java-test-report/**}'
               - '!**/*.md'
               - '!**/LICENSE*'
               - '!**/.gitignore'

@@ -33,7 +33,7 @@ These secrets power the GitHub Agentic Workflows (gh-aw) used for issue triage,
 
 ## Java publishing secrets
 
-These secrets are used by the Java SDK Maven Central publishing workflow (`java-publish-maven.yml`) and the snapshot publishing workflow (`java-publish-snapshot.yml`).
+These secrets support Java SDK Maven Central publishing, snapshot publishing, and post-release documentation deployment.
 
 * **`JAVA_MAVEN_CENTRAL_USERNAME`**: Username generated by a Maven Central Portal user token.
   * Workflows: `java-publish-maven.yml`, `java-publish-snapshot.yml`
@@ -47,11 +47,8 @@ These secrets are used by the Java SDK Maven Central publishing workflow (`java-
 * **`JAVA_GPG_PASSPHRASE`**: Passphrase for the GPG signing key.
   * Workflows: `java-publish-maven.yml`
 
-* **`JAVA_RELEASE_TOKEN`**: GitHub token with **push** permission on the repository. Used by the release workflow for `actions/checkout`, pushing release commits and tags to `main`, and running `mvn release:prepare -DpushChanges=true`.
-  * Workflows: `java-publish-maven.yml`
-
 * **`JAVA_RELEASE_GITHUB_TOKEN`**: GitHub token with **workflow dispatch** (actions:write) permission on `github/copilot-sdk-java`. Used to trigger the documentation site deployment after a release is published.
-  * Workflows: `java-publish-maven.yml`
+  * Workflows: `publish.yml`
 
 ## Rust publishing secret
 

@@ -661,6 +661,32 @@ mvn clean package -pl copilot-native -DskipTests -Dcopilot.native.libc=glibc -Dc
 
 Each classifier JAR includes `runtime.node`, `platform.properties`, and `copilot-runtime` (or `copilot-runtime.exe`) under its `native/<classifier>` directory. It does not contain the legacy `copilot` SEA. The placeholder JAR remains OS-neutral and contains no native binaries. Unsupported hosts retain the placeholder-only behavior.
 
+### Versioning and releases
+
+The Java SDK uses [Maven CI-friendly versions](https://maven.apache.org/maven-ci-friendly.html). Every module declares `<version>${revision}</version>`, and the single source of truth is the `<revision>` property in `java/pom.xml`. The committed value stays a `-SNAPSHOT` (for example `1.0.14-SNAPSHOT`) and is only used for local development and the daily snapshot publish.
+
+Releasing is intentionally a **read-only** operation that never mutates the repository:
+
+- The release version is computed by the shared release pipeline (`.github/workflows/publish.yml`) — the same version used by every other language SDK — and injected at build time with `-Drevision=X.Y.Z`. The POM is **not** edited or committed.
+- `.github/workflows/java-publish-maven.yml` builds every native classifier and the primary artifact from a single immutable source commit and publishes to Maven Central. It creates no commits, no branch-protection bypass, and requires no elevated repository token.
+- The `java/vX.Y.Z` traceability tag and the cross-language `vX.Y.Z` GitHub Release are created by `publish.yml` **after** publication succeeds, pointing at the original release commit.
+
+For an independent Java publication retry, dispatch `java-publish-maven.yml` from `main` with the original `releaseVersion` and full `sourceSha`. The source must be a commit already in `main`'s history. Unmerged commits, branch names, and tag names are rejected before builds run.
+
+Because there is no `maven-release-plugin` and no `release:prepare` ceremony, the POM deliberately does not track the "next" release version. To validate a build with an explicit version locally, without publishing:
+
+```bash
+# Build and verify with an explicit version, without touching the POM
+mvn clean verify -Drevision=1.2.3
+
+# Inspect the generated flattened POMs for the literal version (no ${revision})
+cat sdk/.flattened-pom.xml copilot-native/.flattened-pom.xml
+```
+
+These commands do not upload artifacts. Do not use `deploy` for local validation: the Central publishing plugin is configured with `autoPublish=true`.
+
+`flatten-maven-plugin` (ossrh mode) resolves `${revision}` into the installed and published POMs, so downstream consumers never see the unresolved property. Documentation version references are updated through a normal reviewed pull request (see `scripts/update-documentation-versions.sh`), not as a side effect of publishing.
+
 ## License
 
 MIT — see [LICENSE](../LICENSE) for details.
@@ -8,7 +8,7 @@
     <parent>
         <groupId>com.github</groupId>
         <artifactId>copilot-sdk-java-parent</artifactId>
-        <version>1.0.15-preview.1-SNAPSHOT</version>
+        <version>${revision}</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -884,30 +884,6 @@
                 </plugins>
             </build>
         </profile>
-        <!--
-            Keep the end-to-end local deployment check entirely local while
-            exercising the same deploy lifecycle used by releases.
-        -->
-        <profile>
-            <id>local-publication-validation</id>
-            <activation>
-                <property>
-                    <name>copilot.native.test.local.publication</name>
-                    <value>true</value>
-                </property>
-            </activation>
-            <build>
-                <plugins>
-                    <plugin>
-                        <groupId>org.sonatype.central</groupId>
-                        <artifactId>central-publishing-maven-plugin</artifactId>
-                        <configuration>
-                            <skipPublishing>true</skipPublishing>
-                        </configuration>
-                    </plugin>
-                </plugins>
-            </build>
-        </profile>
         <!--
             Skip the npm download when building offline or when only the
             placeholder JAR is needed: mvn -Dcopilot.native.skip.download=true