ci: bootstrap Release Please for BuildSystem artifacts

.github/workflows/release-please.yml

@@ -0,0 +1,27 @@
+name: Release Please
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: release-please-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-please:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    steps:
+      - name: Create or update the release PR
+        uses: googleapis/release-please-action@v5
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.github/workflows/release.yml

@@ -1,23 +1,26 @@
 name: Release
 
 # Ours, not upstream's. `publish.yml` next door pushes upstream's coordinates to Sonatype and is
-# fenced to their owner id, so it can never fire here — this builds the two jars a build server
-# actually installs and attaches them to a GitHub release.
+# fenced to their owner id, so it can never fire here. Release Please creates the release;
+# this workflow only attaches the two jars a build server actually installs.
 on:
-  push:
-    tags: [ 'v*' ]
+  release:
+    types: [published]
 
 permissions:
   contents: write
   packages: read
 
 jobs:
   release:
+    if: startsWith(github.event.release.tag_name, 'v')
     runs-on: ubuntu-24.04-arm
 
     steps:
       - name: Checkout Git Repository
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
 
       - name: Set up JDK 25
         uses: actions/setup-java@v5
@@ -30,21 +33,25 @@ jobs:
 
       - name: Version from the tag
         id: version
-        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: printf 'version=%s\n' "${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT"
 
       # -Pversion rather than an edit to gradle.properties: that file belongs to upstream, and
       # every line of it we change is a line a future merge has to argue about.
       - name: Build
         env:
           GITHUB_ACTOR: ${{ github.actor }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: ./gradlew clean build -Pversion=${{ steps.version.outputs.version }}
+          RELEASE_VERSION: ${{ steps.version.outputs.version }}
+        run: ./gradlew clean build "-Pversion=$RELEASE_VERSION"
 
-      - name: Release
-        uses: softprops/action-gh-release@v2
-        with:
-          name: ${{ github.ref_name }}
-          generate_release_notes: true
-          files: |
-            build/libs/BuildSystem-${{ steps.version.outputs.version }}.jar
-            build/libs/GroundsMaps-${{ steps.version.outputs.version }}.jar
+      - name: Attach artifacts to the existing Release Please release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          gh release upload "$RELEASE_TAG" \
+            "build/libs/BuildSystem-${RELEASE_TAG#v}.jar" \
+            "build/libs/GroundsMaps-${RELEASE_TAG#v}.jar"

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "4.0.0-grounds.16"
+}

GROUNDS.md

@@ -309,3 +309,21 @@ a token minted by one cluster does not verify against the other's JWKS.
 in which a tick could write a region file mid-archive. The complete fix is to unload the world, pack
 it, and load it back; that is more disruptive to a builder standing in it, and worth doing once
 pushes are frequent enough for the risk to be real.
+
+## Release ownership
+
+Release Please owns Grounds version bumps, release PRs, tags and GitHub releases.
+The initial manifest and `version.txt` record the existing
+`v4.0.0-grounds.16` release, not a new version. The bootstrap SHA is that tag's
+commit, so the first release PR includes the subsequent Grounds changes.
+Release Please calculates the next version from conventional commits; do not
+create tags or releases manually.
+
+The organization `RELEASE_PLEASE_TOKEN` must remain available to this repository.
+Unlike `GITHUB_TOKEN`, it allows release-PR checks and the `release.published`
+artifact build to run. After a reviewed release PR is merged, Release Please
+publishes the release; `release.yml` checks out its exact tag, builds with that
+version and attaches both `BuildSystem` and `GroundsMaps` JARs without creating
+another release or changing its notes. Existing assets are not overwritten.
+Upstream `gradle.properties` and the Sonatype workflow remain
+unchanged. Release publication does not deploy or restart the build server.

release-please-config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bootstrap-sha": "e5594304c75cfc1f0e5f203033b5dce8d272dc69",
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "package-name": "buildsystem",
+      "include-component-in-tag": false
+    }
+  }
+}

version.txt

@@ -0,0 +1 @@
+4.0.0-grounds.16