ci: 统一 workflow 写法，并把 Maven 密钥限定在独立的 publish 任务 [skip ci]

[skip ci]

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -1,43 +0,0 @@
-name: Build and publish
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: https://github.com/actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-        with:
-          persist-credentials: false
-          submodules: recursive
-      - uses: https://github.com/actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
-        with:
-          distribution: zulu
-          java-version: '25'
-      - name: Set development version
-        run: echo "ORG_GRADLE_PROJECT_releaseVersion=0.1.0-dev.${GITHUB_RUN_ID}.${GITHUB_RUN_ATTEMPT:-1}.${GITHUB_SHA:0:12}" >> "$GITHUB_ENV"
-      - name: Check and assemble distribution
-        run: bash ./gradlew --no-daemon check :proxy-core:distZip
-      - name: Upload build outputs
-        uses: https://github.com/actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
-        with:
-          name: moonbridge-development
-          path: |
-            **/build/libs/*.jar
-            !luckperms-moonbridge/build/libs/*-engine.jar
-            !vendor/**/build/libs/*.jar
-            proxy-core/build/distributions/*.zip
-          if-no-files-found: error
-          retention-days: 30
-      - name: Publish all Maven modules
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-        run: |
-          test -n "$MAVEN_USER" && test -n "$MAVEN_PASSWORD" || { echo 'MAVEN_USER and MAVEN_PASSWORD are required'; exit 1; }
-          bash ./gradlew --no-daemon publish

.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+name: Build and publish
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish the Maven modules ('true' or 'false')
+        required: false
+        default: 'true'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        with:
+          distribution: zulu
+          java-version: '25'
+
+      - name: Set development version
+        run: echo "ORG_GRADLE_PROJECT_releaseVersion=0.1.0-dev.${GITHUB_RUN_ID}.${GITHUB_RUN_ATTEMPT:-1}.${GITHUB_SHA:0:12}" >> "$GITHUB_ENV"
+
+      - name: Check and assemble distribution
+        run: bash ./gradlew --no-daemon check :proxy-core:distZip
+
+      - name: Upload build outputs
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
+        with:
+          name: moonbridge-development
+          path: |
+            **/build/libs/*.jar
+            !luckperms-moonbridge/build/libs/*-engine.jar
+            !vendor/**/build/libs/*.jar
+            proxy-core/build/distributions/*.zip
+          if-no-files-found: error
+          retention-days: 30
+
+  publish:
+    # Runs only after the build above passed. The Maven credentials exist in this job and nowhere else.
+    needs: build
+    if: ${{ github.event_name == 'push' || inputs.publish == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      MAVEN_USER: ${{ secrets.MAVEN_USER }}
+      MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        with:
+          distribution: zulu
+          java-version: '25'
+
+      - name: Set development version
+        run: echo "ORG_GRADLE_PROJECT_releaseVersion=0.1.0-dev.${GITHUB_RUN_ID}.${GITHUB_RUN_ATTEMPT:-1}.${GITHUB_SHA:0:12}" >> "$GITHUB_ENV"
+
+      - name: Check the publish credentials
+        run: |
+          if [[ -z "$MAVEN_USER" || -z "$MAVEN_PASSWORD" ]]; then
+            echo "::error::MAVEN_USER and MAVEN_PASSWORD are not set; cannot publish"
+            exit 1
+          fi
+
+      - name: Publish all Maven modules
+        run: bash ./gradlew --no-daemon publish

.github/workflows/verify.yml

@@ -11,11 +11,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: https://github.com/actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
         with:
           persist-credentials: false
           submodules: recursive
-      - uses: https://github.com/actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
         with:
           distribution: zulu
           java-version: '25'