fix: ensure release tag points to non-snapshot release commit (#3582)

Signed-off-by: Lavanya N M <lavanyanm75@gmail.com>

Author: Lavanya-N24

.github/workflows/release-project-in-dir.yml

@@ -9,19 +9,28 @@ on:
       version_branch:
         type: string
         required: true
+      release_tag:
+        type: string
+        required: true
 
 env:
-#  set the target pom to use the input directory as root
+  # set the target pom to use the input directory as root
   MAVEN_ARGS: -V -ntp -e -f ${{ inputs.project_dir }}/pom.xml
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    outputs:
+      release_sha: ${{ steps.resolve-sha.outputs.commit }}
     steps:
-      - name: Checkout "${{inputs.version_branch}}" branch
+      - name: Checkout "${{ inputs.version_branch }}" branch
         uses: actions/checkout@v7
         with:
-          ref: "${{inputs.version_branch}}"
+          ref: "${{ inputs.version_branch }}"
+
+      - name: Resolve checked-out commit
+        id: resolve-sha
+        run: echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Set up Java and Maven
         uses: actions/setup-java@v6
@@ -36,11 +45,11 @@ jobs:
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Change version to release version
-        # Assume that RELEASE_VERSION will have form like: "v1.0.1". So we cut the "v"
-        run: |
-          ./mvnw ${MAVEN_ARGS} versions:set -DnewVersion="${RELEASE_VERSION:1}" versions:commit -DprocessAllModules
         env:
-          RELEASE_VERSION: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          RELEASE_VERSION="${RELEASE_TAG#v}"
+          ./mvnw ${MAVEN_ARGS} versions:set -DnewVersion="${RELEASE_VERSION}" versions:commit -DprocessAllModules
 
       - name: Publish to Apache Maven Central
         run: ./mvnw package deploy -Prelease
@@ -49,16 +58,64 @@ jobs:
           MAVEN_CENTRAL_TOKEN: ${{ secrets.NEXUS_PASSWORD }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
-  # This is separate job because there were issues with git after release step, was not able to commit changes.
-  update-working-version:
+  finalize-release:
     runs-on: ubuntu-latest
     needs: publish
-    if: "!contains(github.event.release.tag_name, 'RC')" # not sure we should keep this the RC part
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout exact published commit
+        uses: actions/checkout@v4
+        with:
+          ref: "${{ needs.publish.outputs.release_sha }}"
+          fetch-depth: 0
+
+      - name: Set up Java and Maven
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: temurin
+          cache: 'maven'
+
+      - name: Change version to release version
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          RELEASE_VERSION="${RELEASE_TAG#v}"
+          ./mvnw ${MAVEN_ARGS} versions:set -DnewVersion="${RELEASE_VERSION}" versions:commit -DprocessAllModules
+
+      - name: Commit and push release version
+        env:
+          TARGET_BRANCH: ${{ inputs.version_branch }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          if git diff --quiet; then
+            echo "No version changes to commit."
+          else
+            git commit -am "Release ${RELEASE_TAG}"
+            git push origin HEAD:"${TARGET_BRANCH}"
+          fi
+
+      - name: Override release tag to point to release commit
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          git tag -f -a "${RELEASE_TAG}" -m "Release ${RELEASE_TAG}"
+          git push -f origin "refs/tags/${RELEASE_TAG}"
+
+  update-working-version:
+    runs-on: ubuntu-latest
+    needs: finalize-release
+    permissions:
+      contents: write
+    if: "!contains(inputs.release_tag, 'RC')"
     steps:
-      - name: Checkout "${{inputs.version_branch}}" branch
+      - name: Checkout "${{ inputs.version_branch }}" branch
         uses: actions/checkout@v7
         with:
-          ref: "${{inputs.version_branch}}"
+          ref: "${{ inputs.version_branch }}"
 
       - name: Set up Java and Maven
         uses: actions/setup-java@v6
@@ -73,11 +130,9 @@ jobs:
           git config --local user.email "action@github.com"
           git config --local user.name "GitHub Action"
           git commit -m "Set new SNAPSHOT version into pom files." -a
-        env:
-          RELEASE_VERSION: ${{ github.event.release.tag_name }}
 
       - name: Push changes to branch
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v0.8.0
         with:
-          branch: "${{inputs.version_branch}}"
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          branch: "${{ inputs.version_branch }}"
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -15,8 +15,10 @@ jobs:
     timeout-minutes: 10
     env:
       tmp_version_branch: ''
+      RAW_TAG: ${{ github.event.release.tag_name }}
     outputs:
       version_branch: ${{ steps.set-version-branch.outputs.version_branch }}
+      release_tag: ${{ steps.set-release-tag.outputs.release_tag }}
     steps:
       - if: ${{ startsWith(github.event.release.tag_name, 'v1.' ) }}
         run: |
@@ -98,7 +100,10 @@ jobs:
           exit 1
       - id: set-version-branch
         name: Set version_branch if matched
-        run: echo "version_branch=${{env.tmp_version_branch}}" >> $GITHUB_OUTPUT
+        run: echo "version_branch=${{ env.tmp_version_branch }}" >> "$GITHUB_OUTPUT"
+      - id: set-release-tag
+        name: Pass release tag
+        run: echo "release_tag=${RAW_TAG}" >> "$GITHUB_OUTPUT"
 
   release-sdk:
     needs: prepare-release
@@ -108,5 +113,6 @@ jobs:
     uses: ./.github/workflows/release-project-in-dir.yml
     secrets: inherit
     with:
-      version_branch: ${{needs.prepare-release.outputs.version_branch}}
-      project_dir: '.'
+      version_branch: ${{ needs.prepare-release.outputs.version_branch }}
+      release_tag: ${{ needs.prepare-release.outputs.release_tag }}
+      project_dir: '.'