ci: 统一 workflow 写法，并把 Maven 密钥限定在独立的 publish 任务 [skip ci]

[skip ci]

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+name: Build and publish
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish the Maven modules ('true' or 'false')
+        required: false
+        default: 'true'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        with:
+          distribution: zulu
+          java-version: '25'
+
+      - name: Set development version
+        run: echo "ORG_GRADLE_PROJECT_releaseVersion=0.1.0-dev.${GITHUB_RUN_ID}.${GITHUB_RUN_ATTEMPT:-1}.${GITHUB_SHA:0:12}" >> "$GITHUB_ENV"
+
+      - name: Check and assemble distribution
+        run: bash ./gradlew --no-daemon check :proxy-core:distZip
+
+      - name: Upload build outputs
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
+        with:
+          name: moonbridge-development
+          path: |
+            **/build/libs/*.jar
+            !luckperms-moonbridge/build/libs/*-engine.jar
+            !vendor/**/build/libs/*.jar
+            proxy-core/build/distributions/*.zip
+          if-no-files-found: error
+          retention-days: 30
+
+  publish:
+    # Runs only after the build above passed. The Maven credentials exist in this job and nowhere else.
+    needs: build
+    if: ${{ github.event_name == 'push' || inputs.publish == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      MAVEN_USER: ${{ secrets.MAVEN_USER }}
+      MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        with:
+          distribution: zulu
+          java-version: '25'
+
+      - name: Set development version
+        run: echo "ORG_GRADLE_PROJECT_releaseVersion=0.1.0-dev.${GITHUB_RUN_ID}.${GITHUB_RUN_ATTEMPT:-1}.${GITHUB_SHA:0:12}" >> "$GITHUB_ENV"
+
+      - name: Check the publish credentials
+        run: |
+          if [[ -z "$MAVEN_USER" || -z "$MAVEN_PASSWORD" ]]; then
+            echo "::error::MAVEN_USER and MAVEN_PASSWORD are not set; cannot publish"
+            exit 1
+          fi
+
+      - name: Publish all Maven modules
+        run: bash ./gradlew --no-daemon publish

.github/workflows/verify.yml

@@ -0,0 +1,25 @@
+name: Verify MoonBridge
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        with:
+          distribution: zulu
+          java-version: '25'
+      - name: Check
+        run: |
+          chmod +x ./gradlew
+          ./gradlew --no-daemon check