Verify version increment before publishing to Maven Local

[alexander-yevsyukov]

What

IncrementGuard now runs the checkVersionIncrement task before publishing to Maven Local, not only on CI pull requests.

• Every publishToMavenLocal task now depends on checkVersionIncrement (via tasks.withType(PublishToMavenLocal::class.java).configureEach { dependsOn(...) }).
• The static enabled = false gate is replaced with an onlyIf predicate, so the check actually runs for local (non-CI) Maven Local publishes.
• check is wired lazily through the existing io.spine.gradle.base.check accessor instead of eager getByName.

Why

Projects like core-jvm-compiler publish artifacts to ~/.m2 so their integration tests consume them. Bumping the project version before ./gradlew build is critical there: without a bump, a local publish overwrites an already-published version and the integration tests silently pick up a stale artifact. The previous guard only fired on CI pull requests, catching the problem too late.

CI safety

The local-publish path is gated by !Build.ci. CI pushes and tag builds that publish locally (e.g. to feed integration tests) keep succeeding even when their version is already published — preserving the original behavior that avoids failing master re-builds. The decision is a pure function mustVerify(ciPullRequest, onCi, localPublish):

Build	Check runs?
CI PR → protected branch	✅ (unchanged)
Local build, publishes to Maven Local	✅ new
Local build, no publish	⏭️ skipped, no network call (unchanged)
CI push/tag, publishes locally	⏭️ skipped — master re-builds stay green

Trade-off

A local publishToMavenLocal now fetches maven-metadata.xml from the registry first — this is the intended safeguard. Offline local publishes need network access or the documented escape hatch -x checkVersionIncrement.

Testing

./gradlew :buildSrc:build detekt (JDK 17) passes — compilation, validatePlugins, all tests, and detekt. Added 6 IncrementGuardTest cases: a 4-row truth table for mustVerify and 2 ProjectBuilder wiring tests asserting both check and a PublishToMavenLocal task depend on checkVersionIncrement.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ea8010142f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR updates the IncrementGuard Gradle plugin (in buildSrc) so checkVersionIncrement is evaluated before publishing to Maven Local, not only during CI pull requests, preventing local publishes from silently overwriting already-published versions that integration tests might later consume.

Changes:

• Adds a mustVerify(ciPullRequest, onCi, localPublish) predicate and switches from enabled=false to an onlyIf spec so the check can run for local Maven Local publishes.
• Wires checkVersionIncrement as a dependency of both the check lifecycle task and all PublishToMavenLocal tasks.
• Expands tests to cover mustVerify decisions and to assert the Gradle task dependency wiring.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
buildSrc/src/main/kotlin/io/spine/gradle/publish/IncrementGuard.kt	Adds the new verification predicate, switches gating to onlyIf, and wires the check before check and publishToMavenLocal.
buildSrc/src/test/kotlin/io/spine/gradle/publish/IncrementGuardTest.kt	Adds decision-table tests for mustVerify and wiring tests for check and PublishToMavenLocal dependencies.