ci: derive the published version from the tag and add a changelog

The version was a literal in build.gradle.kts while the deploy workflow triggered
on v* tags and picked its target repository from the -SNAPSHOT suffix. Pushing
v7.0.0 without editing the build first therefore published 7.0.0-SNAPSHOT to the
snapshots repository and reported success — the one class of mistake that cannot
be undone afterwards, since a published coordinate is immutable.

The version now comes from the tag, guarded by GITHUB_REF_TYPE so a branch build
does not publish a version named after the branch, and the workflow checks both
that the tag looks like a version and that the build agrees with it before
anything is published.

Verified: no env -> 7.0.0-SNAPSHOT, tag v7.0.0 -> 7.0.0, branch main ->
7.0.0-SNAPSHOT, tag v7.1.0-rc.1 -> 7.1.0-rc.1.

The changelog starts at 7.0.0; its content is the README's migration guide plus
the fixes made while preparing this release. The date is left open until the tag
is actually cut.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 7agustibm

.github/README.md

@@ -27,7 +27,7 @@ application. Schemas are generated from Kotlin (or Java) classes by
 
 > **7.0.0 is not released yet.** There is a `7.0.0-SNAPSHOT` to try, published to Javalin's
 > Reposilite. See [#7](https://github.com/javalin/javalin-graphql/issues/7) for the release
-> and Maven Central discussion.
+> and Maven Central discussion, and the [changelog](../CHANGELOG.md) for what is in it.
 
 Add the dependency:
 

.github/workflows/deploy.yml

@@ -26,10 +26,33 @@ jobs:
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      # The build derives the version from the tag, so a tag that is not a version would be
+      # published verbatim. Reject it before anything is built.
+      - name: Check the tag is a version tag
+        if: github.ref_type == 'tag'
+        run: |
+          if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then
+            echo "::error::Tag '$GITHUB_REF_NAME' is not a version tag (expected vMAJOR.MINOR.PATCH)."
+            exit 1
+          fi
+
       - name: Read version
         id: version
         run: echo "value=$(./gradlew -q printVersion)" >> "$GITHUB_OUTPUT"
 
+      # If the derivation ever falls back to the snapshot default on a tag build — a missing
+      # GITHUB_REF_TYPE, a checkout that lost the tag, a change to build.gradle.kts — this run
+      # would quietly overwrite a snapshot instead of releasing. Fail instead.
+      - name: Check the version matches the tag
+        if: github.ref_type == 'tag'
+        run: |
+          expected="${GITHUB_REF_NAME#v}"
+          actual="${{ steps.version.outputs.value }}"
+          if [[ "$actual" != "$expected" ]]; then
+            echo "::error::Tag '$GITHUB_REF_NAME' would publish '$actual', expected '$expected'."
+            exit 1
+          fi
+
       # A manual run may only publish a snapshot; releasing is what the tag is for.
       - name: Refuse to release without a tag
         if: github.event_name == 'workflow_dispatch' && !endsWith(steps.version.outputs.value, '-SNAPSHOT')

CHANGELOG.md

@@ -0,0 +1,79 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The major version
+tracks Javalin's: 7.x targets Javalin 7.x. Releases up to 5.x predate this file.
+
+## [Unreleased]
+
+## [7.0.0] - unreleased
+
+The first release for Javalin 7 and graphql-kotlin 10. Everything under *Changed* and *Removed*
+is a breaking change; the README has a
+[migration guide](.github/README.md#migrating-from-5x) and `docs/adr` has the reasoning.
+
+### Added
+
+- Subscriptions are served over the
+  [graphql-transport-ws](https://github.com/enisdenjo/graphql-ws/blob/master/PROTOCOL.md)
+  protocol: `connection_init` / `connection_ack`, `ping` / `pong`, `subscribe` with an operation
+  id, `next`, `error`, `complete`, and the close codes 4400, 4401, 4409 and 4429 (ADR-002).
+- Several subscriptions can run concurrently on one connection, each cancellable by id with
+  `complete`, and all of them are cancelled when the socket closes or the server stops.
+- `disableGraphiQL()`, for an application that does not want to publish a schema explorer.
+- `Automatic-Module-Name: io.javalin.community.graphql`, so a modular application can
+  `requires` the plugin ([#5](https://github.com/javalin/javalin-graphql/issues/5), ADR-004).
+- Architecture decision records under `docs/adr`.
+- Continuous integration: build and test on JDK 17 and 21 across Linux, macOS and Windows,
+  plus detekt.
+- The published version is derived from the release tag.
+
+### Changed
+
+- Javalin 7.2.2, graphql-kotlin 10.2.0, JVM baseline 17.
+- `config.plugins.register(...)` is now `config.registerPlugin(...)`.
+- The context is graphql-java's map-like `GraphQLContext` instead of a type of yours, and a
+  resolver reads it from the `DataFetchingEnvironment` rather than receiving it as a parameter
+  (ADR-001). `GraphQLPluginBuilder` lost its context type parameter.
+- The context factories are now optional constructor arguments of `GraphQLPluginBuilder`, and
+  the constructor is annotated `@JvmOverloads` so Java can leave them out.
+- `GraphQLPluginBuilder.add(...)` is now `addPackage(...)`, and at least one package is
+  required.
+- Subscription resolvers return a kotlinx `Flow` instead of a reactive-streams `Publisher`;
+  Reactor is no longer a dependency.
+- GraphiQL is pinned to 4.1.2 with React 18.3.1, both by version and by SRI hash, and its
+  fetcher now points at the subscription WebSocket as well as the POST endpoint.
+- Payloads are parsed without graphql-kotlin's sealed types, so the plugin works with whatever
+  `JsonMapper` the application configured (ADR-003).
+- The public API dependencies are exposed as `api` rather than `implementation`, so the
+  examples in the README compile against the artifact.
+- The Kotlin sources moved from `src/main/java` to `src/main/kotlin`.
+
+### Removed
+
+- `GraphQLOptions`, together with `GraphQLPluginBuilder.create(options)` and the
+  `GraphQLPlugin(options)` constructor. `GraphQLPluginBuilder` is the only entry point.
+- `middleHandler`, `wsMiddleHandler`, `setMiddleHandler`, `setWSMiddleHandler` and the
+  `context` argument of `GraphQLOptions`: nothing ever read them, so a `middleHandler` set to
+  authorize requests was silently dropped. Javalin's `before` and `beforeWs` do that job.
+- `GraphQLRun` — use `GraphQLRequestHandler.executeSubscription`.
+- `JavalinDataLoaderRegistryFactory` — use graphql-kotlin's `KotlinDataLoaderRegistryFactory`.
+- The ad-hoc 5.x WebSocket exchange (a bare query frame answered with bare result data).
+
+### Fixed
+
+- A subscription no longer pins a Jetty thread for its whole lifetime, and stopping the server
+  cancels the ones still running instead of leaking their coroutines.
+- A malformed payload is answered with a 400 over HTTP and a 4400 close over WebSocket instead
+  of a 500 or a dropped connection.
+- A resolver that throws is reported as a protocol `error` frame for its operation instead of
+  tearing down the whole connection.
+- GraphiQL loaded unversioned scripts from a CDN, so it broke as soon as upstream released an
+  incompatible major, and it requested a `renderExample.js` that does not exist.
+- Building the plugin without registering a package now fails saying so, instead of scanning
+  the package `kotlin.Unit`, which is a class and matches nothing.
+
+[Unreleased]: https://github.com/javalin/javalin-graphql/compare/v7.0.0...HEAD
+[7.0.0]: https://github.com/javalin/javalin-graphql/releases/tag/v7.0.0

build.gradle.kts

@@ -12,7 +12,16 @@ detekt {
 }
 
 group = "io.javalin.community.graphql"
-version = "7.0.0-SNAPSHOT"
+
+// The published version is the tag the release workflow runs on: v7.0.0 publishes 7.0.0.
+// Anywhere else — a developer machine, a branch build, a manual snapshot publish — it is the
+// snapshot below, so nothing can release by accident. GITHUB_REF_TYPE is what distinguishes
+// the two: on a branch push GITHUB_REF_NAME is the branch name. deploy.yml cross-checks both.
+version = System.getenv("GITHUB_REF_NAME")
+    ?.takeIf { System.getenv("GITHUB_REF_TYPE") == "tag" }
+    ?.removePrefix("v")
+    ?.takeIf { it.isNotBlank() }
+    ?: "7.0.0-SNAPSHOT"
 
 repositories {
     mavenCentral()