CI verifies and packages branch pushes and pull requests. Publishing happens only when a Forgejo Release is published.

Run CI and releases on the default branch with prepare_release enabled. The version is derived from the POM (or Mobileng's frontend/package.json). Preparation commits matching Maven/npm/lockfile versions, creates a Forgejo release whose tag points to that release commit, and leaves the default branch at the next patch version with -SNAPSHOT. The release-publishing workflow builds only the tagged commit and rejects inconsistent source versions; it never rewrites a published tag.

Preparation is idempotent when rerunning the same dispatch after its version commits were pushed. An unrelated branch change stops preparation. A normal fast-forward push prevents concurrent preparations from overwriting source.

Configure a separate Forgejo Actions (Local) Authorized Integration for release preparation: select this source repository, workflow ci.yml, Git reference refs/heads/master, and event workflow_dispatch. Choose Specific repositories and select only this repository; grant only repository Read and write. Store its public audience in RELEASE_PREPARE_AUDIENCE. Existing tag-scoped publishing integrations remain unchanged.

Create a Forgejo Actions (Local) Authorized Integration restricted to source cpn-tools/gradecpn, workflow ci.yml and reference refs/tags/*. Choose Specific repositories, select only this repository, and grant only repository Read and write. Store its audience in the repository Actions variable RELEASE_AUDIENCE. It permits attaching release assets. If event selection is available, restrict it to release; these workflows request credentials only during release jobs.

Create a second integration with the same source repository, workflow and reference conditions. Choose All resources and grant only package Read and write; leave every other permission at No access. Store its audience as PUBLISH_AUDIENCE. Forgejo does not support package permission with Specific repositories. The package credential is restricted by the source workflow conditions and the configuring account’s existing package access.

Audiences are public identifiers. No static publishing token is required. The runner label is ubuntu-latest. Java 8 and Maven 3.9.12 are installed by the workflow.

Test and coverage reports are retained as workflow artifacts. Documentation-site generation and publication are deferred.

All Maven reactor POMs and packaged artifacts are retained. Release versions update module versions and internal reactor references together; external dependency versions remain explicit.