Deploy artifact signing with sigstore

.github/workflows/deploy-release.yml

@@ -9,6 +9,7 @@ jobs:
       runs-on: ubuntu-latest
       permissions:
         contents: write
+        id-token: write
       steps:
         - uses: actions/checkout@v4
         - name: Set up JDK
@@ -36,7 +37,7 @@ jobs:
         - run: mv target/boot-properties-logger-starter-${{steps.version.outputs.prop}}.jar target/boot-properties-logger-starter.jar
         - name: Create Release
           id: create_release
-          uses: ncipollo/release-action@v1.16.0
+          uses: ncipollo/release-action@v1.20.0
           with:
             tag: v${{steps.version.outputs.prop}}
             commit: master

README.md

@@ -195,3 +195,11 @@ methods. If you have no other choice (make sure you had a complete look to
 [the numerous ways to override properties in Spring Boot](https://docs.spring.io/spring-boot/reference/features/external-config.html) )
 that defining `@DynamicPropertySource` methods to override properties in a test and you want to check the value of the 
 overrided property, consider logging it yourself or write an assertion in your test
+
+## Maintainers notes
+
+- to update pom.xml if one can't get dependabot, find updates with :
+    ```
+    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-property-updates
+    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-parent-updates
+    ```

pom.xml

@@ -12,14 +12,9 @@
 
     <groupId>io.github.fbibonne</groupId>
     <artifactId>boot-properties-logger-starter</artifactId>
-    <version>2.0.0</version>
+    <version>${sigstore-maven-plugin.version}</version>
     <packaging>jar</packaging>
 
-    <!-- If you can't get dependabot, find updates with :
-    ```
-    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-property-updates
-    mvn -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:display-parent-updates
-    ``` -->
     <properties>
         <jspecify.version>1.0.0</jspecify.version>
         <maven.compiler.source>17</maven.compiler.source>
@@ -29,6 +24,7 @@
         <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
         <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
         <central-publishing-maven-plugin.version>0.10.0</central-publishing-maven-plugin.version>
+        <sigstore-maven-plugin.version>2.0.0</sigstore-maven-plugin.version>
     </properties>
 
     <name>Spring Boot Properties Logger</name>
@@ -163,6 +159,20 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>dev.sigstore</groupId>
+                <artifactId>sigstore-maven-plugin</artifactId>
+                <version>${sigstore-maven-plugin.version}</version>
+                <executions>
+                    <execution>
+                        <id>sign</id>
+                        <phase>install</phase>
+                        <goals>
+                            <goal>sign</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.sonatype.central</groupId>
                 <artifactId>central-publishing-maven-plugin</artifactId>
@@ -171,7 +181,6 @@
                 <configuration>
                     <publishingServerId>central</publishingServerId>
                     <deploymentName>Properties-Logger</deploymentName>
-                    <autoPublish>true</autoPublish>
                 </configuration>
             </plugin>
         </plugins>