Verify Java SDK publish tag version

Author: diebel+1-at-601609176474

.github/workflows/publish.yml

@@ -23,6 +23,15 @@ jobs:
           java-version: "17"
           cache: gradle
 
+      - name: Verify tag version
+        run: |
+          tag_version="${GITHUB_REF_NAME#v}"
+          package_version="$(awk -F\"'\" '/^version = / { print $2; exit }' build.gradle)"
+          if [ "$package_version" != "$tag_version" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match package version $package_version"
+            exit 1
+          fi
+
       - name: Stage Maven artifacts
         run: ./gradlew publishMavenPublicationToStagingRepository --no-daemon
 

PUBLISHING.md

@@ -12,4 +12,4 @@ Configure Maven Central namespace ownership for `ai.vectorizer`, then add these
 - `JRELEASER_GPG_SECRET_KEY`
 - `JRELEASER_GPG_PASSPHRASE`
 
-After that, push a SemVer tag such as `v1.0.0`. The workflow stages, signs, and deploys Maven artifacts, then creates a GitHub release.
+After that, update the generated package version, commit it, and push a matching SemVer tag such as `v1.0.0`. The workflow verifies that the tag matches `build.gradle`, stages, signs, and deploys Maven artifacts, then creates a GitHub release.