From 5c5e1462a8280521fe35e496c63a83fda3d6e943 Mon Sep 17 00:00:00 2001
From: Todd Baert <todd.baert@dynatrace.com>
Date: Fri, 2 May 2025 15:48:01 -0400
Subject: [PATCH] chore: update release plz

Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
---
 .github/workflows/release-please.yml | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 98fb03665..5224dd811 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -5,8 +5,11 @@ on:
 name: Run Release Please
 jobs:
   release-please:
-    environment: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # for googleapis/release-please-action to create release commit
+      pull-requests: write # for googleapis/release-please-action to create release PR
+      issues: write # for googleapis/release-please-action to create labels
 
     # Release-please creates a PR that tracks all changes
     steps:
@@ -14,14 +17,24 @@ jobs:
         id: release
         with:
           token: ${{secrets.RELEASE_PLEASE_ACTION_TOKEN}}
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      release_tag_name: ${{ steps.release.outputs.tag_name }}
 
+  publish:
+    environment: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: release-please
+    if: ${{ fromJSON(needs.release-please.outputs.release_created || false) }}
+
+    steps:
       # The logic below handles the maven publication:
       - name: Checkout Repository
-        if: ${{ steps.release.outputs.releases_created }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up JDK 21
-        if: ${{ steps.release.outputs.releases_created }}
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
         with:
           java-version: '21'
@@ -32,7 +45,6 @@ jobs:
           server-password: OSSRH_PASSWORD
 
       - name: Cache local Maven repository
-        if: ${{ steps.release.outputs.releases_created }}
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
           path: ~/.m2/repository
@@ -49,7 +61,6 @@ jobs:
 
       # Release Please has already incremented versions and published tags, so we just need to publish (skip tests).
       - name: Maven Verify Deploy -DskipTests
-        if: ${{ steps.release.outputs.releases_created }}
         # The nexus-staging-maven-plugin doesn't follow maven conventions. It stages all the projects with the last submodule: https://help.sonatype.com/repomanager2/staging-releases/configuring-your-project-for-deployment
         # This means there's no way to skip publishing of a particular module in a multi-module build, so we iterate over each module and publish them individually,
         # letting exists-maven-plugin skip the nexus-staging-maven-plugin's entire deploy goal if the artifact exists.