Align the release dispatcher with organisation secrets

.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Compile production code
         run: |
           chmod +x ./gradlew
-          ./gradlew clean classes --no-daemon --stacktrace
+          ./gradlew clean classes --rerun-tasks --no-daemon --stacktrace
 
       - name: Analyze
         uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4

.github/workflows/deploy-release.yml

@@ -340,8 +340,6 @@ jobs:
       - build
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    environment:
-      name: release
     steps:
       - name: Confirm publication and release-secret access
         env:

docs/REPOSITORY.md

@@ -60,12 +60,11 @@ the Gradle wrapper and run CodeQL.
 The manual release dispatcher lives on `master-1.18.2` so GitHub can route a
 four-component version to its matching version/loader branch. It checks the
 branch metadata and successful audited CI result, builds one immutable bundle,
-then requires both the exact live-publication confirmation and approval of the
-`release` environment. Only that bundle may be sent to Maven, CurseForge
-project `1677588`, and the GitHub release. GitHub publication runs last.
+then requires the exact live publication confirmation. Only that bundle may be
+sent to Maven, CurseForge project `1677588`, and the GitHub release. GitHub
+publication runs last.
 
-MMD administrators must expose the existing organisation Maven and CurseForge
-secrets and configure the protected `release` environment for this repository.
+The dispatcher uses the existing organisation Maven and CurseForge secrets.
 No secret belongs in source control.
 
 ## Commits and local context

src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java

@@ -54,7 +54,11 @@ public void releaseDispatcherIsExplicitAndUsesTheImmutableBundle() throws Except
         assertTrue(properties.contains("loader_code=1"));
         assertTrue(properties.contains("curseforge_project_id=1677588"));
         assertTrue(workflow.contains("confirm_live_publication:"));
-        assertTrue(workflow.contains("name: release"));
+        assertFalse(workflow.contains("    environment:\n      name: release"));
+        assertTrue(workflow.contains("CURSEFORGE_TOKEN: ${{ secrets.CURSEFORGE_TOKEN }}"));
+        assertTrue(workflow.contains("MAVEN_UPLOAD_URL: ${{ secrets.MAVEN_UPLOAD_URL }}"));
+        assertTrue(workflow.contains("MAVEN_UPLOAD_USERNAME: ${{ secrets.MAVEN_UPLOAD_USERNAME }}"));
+        assertTrue(workflow.contains("MAVEN_UPLOAD_PASSWORD: ${{ secrets.MAVEN_UPLOAD_PASSWORD }}"));
         assertTrue(workflow.contains("-PpreparedReleaseDir="));
         assertTrue(workflow.contains("MinecraftModDevelopmentMods/SkysGrassSlabs"));
         assertTrue(workflow.indexOf("  publish_maven:") <
@@ -64,6 +68,13 @@ public void releaseDispatcherIsExplicitAndUsesTheImmutableBundle() throws Except
         assertTrue(build.contains("if (preparedReleaseDir.isPresent())"));
     }
 
+    @Test
+    public void codeQlCannotReuseCachedCompilationOutput() throws Exception {
+        String workflow = Files.readString(
+                Path.of(".github/workflows/codeql-analysis.yml"), StandardCharsets.UTF_8);
+        assertTrue(workflow.contains("clean classes --rerun-tasks --no-daemon"));
+    }
+
 
     @Test
     public void commonConfigAndWorldStateUsePermanentKeys() throws Exception {