Release

https://maven.apache.org/guides/mini/guide-releasing.html
https://maven.apache.org/plugins/maven-deploy-plugin/
https://maven.apache.org/plugins/maven-gpg-plugin/
https://maven.apache.org/plugins/maven-release-plugin/

SNAPSHOT:
    mutable development version

release:
    immutable version published once

rule:
    release from CI
    tag source code
    publish artifact to release repository

examples:
    1.4.0-SNAPSHOT
    1.4.0
    1.4.1

rules:
    never overwrite release artifact
    do not depend on SNAPSHOT in production
    bump version in a controlled release job

./mvnw -B -s settings.xml clean deploy

<distributionManagement>
  <repository>
    <id>company-releases</id>
    <url>https://nexus.example.com/repository/maven-releases/</url>
  </repository>
  <snapshotRepository>
    <id>company-snapshots</id>
    <url>https://nexus.example.com/repository/maven-snapshots/</url>
  </snapshotRepository>
</distributionManagement>

check:
    version has no SNAPSHOT
    dependency versions are stable
    plugin versions are explicit
    tests and quality gates pass
    generated POM is consumer-friendly
    changelog and tag are created

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-gpg-plugin</artifactId>
  <version>3.2.4</version>
  <executions>
    <execution>
      <id>sign-artifacts</id>
      <phase>verify</phase>
      <goals>
        <goal>sign</goal>
      </goals>
    </execution>
  </executions>
</plugin>

signing:
    proves artifact publisher identity
    private key must be stored as CI secret

publish library usually includes:
    main jar
    pom
    sources jar
    javadoc jar
    signatures when repository requires them

./mvnw -B clean deploy

maven-release-plugin:
    classic Maven release workflow
    updates versions, commits, tags, deploys

modern CI often prefers:
    explicit version update
    git tag
    mvn deploy

snapshot:
    rebuild and redeploy if repository policy allows

release:
    do not overwrite
    publish a new patch version
    revoke or mark bad artifact in repository manager if needed