feat(bf-4ygdw): add Go and Java publishing workflows

- Add pdftract-go-publish.yaml for Go module publishing via git tags
- Add pdftract-java-publish.yaml for Maven Central publishing via OSSRH
- Both workflows follow existing PHP/Ruby/Swift publish patterns
- Java workflow includes GPG signing and OSSRH staging requirements
- Go workflow triggers pkg.go.dev indexing via proxy ping

Closes bf-4ygdw

Files added:
- .ci/argo-workflows/pdftract-go-publish.yaml
- .ci/argo-workflows/pdftract-java-publish.yaml
- notes/bf-4ygdw.md

References:
- Plan lines 3400-3413 (Release Engineering)
- Plan line 3571 (Go SDK publish channel)
- Plan line 3594 (Java SDK publish channel)
- ADR-009

.ci/argo-workflows/pdftract-go-publish.yaml

@@ -0,0 +1,370 @@
+# pdftract-go-publish WorkflowTemplate
+#
+# Publishes the Go SDK to github.com/jedarden/pdftract-go by creating a git tag.
+# Triggered by the pdftract-release-cascade after pdftract-build-binaries completes.
+# The workflow clones the Go SDK repo, syncs the module version, runs conformance
+# tests, creates a git tag matching the binary version, and pushes it. pkg.go.dev
+# auto-indexes within minutes of the tag being pushed.
+#
+# === Parameter Reference ===
+# - tag: Git tag from the main repo (e.g., v0.1.0)
+# - version: SemVer version string (e.g., 0.1.0)
+#
+# === Steps ===
+# 1. clone-sdk-repo: Clone github.com/jedarden/pdftract-go
+# 2. sync-version: Ensure module version matches the binary tag
+# 3. regenerate: Optionally re-run pdftract sdk codegen (idempotent)
+# 4. conformance: Run go test -run Conformance (must pass to publish)
+# 5. tag-and-push: Create and push git tag v$VERSION
+# 6. warm-pkg-go-dev: Trigger pkg.go.dev indexing
+#
+# === Re-runnability ===
+# A re-run after a partial failure will detect the existing tag and skip the push
+# step (idempotent). The workflow is safe to re-run.
+#
+# Bead: pdftract-dvc2l
+# Plan section: SDK Architecture / Per-SDK Release Channels, line 3571
+# ADR-009: Argo Workflows on iad-ci only
+#
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: pdftract-go-publish
+  namespace: argo-workflows
+  labels:
+    app.kubernetes.io/name: pdftract-go-publish
+    app.kubernetes.io/component: ci
+    app.kubernetes.io/part-of: pdftract
+spec:
+  entrypoint: publish-go-sdk
+  serviceAccountName: argo-workflow
+
+  podGC:
+    strategy: OnPodCompletion
+
+  ttlStrategy:
+    secondsAfterSuccess: 1800
+    secondsAfterFailure: 7200
+
+  arguments:
+    parameters:
+      - name: tag
+        value: ""
+        description: "Git tag from main repo (e.g., v0.1.0)"
+      - name: version
+        value: ""
+        description: "Version extracted from tag (e.g., 0.1.0)"
+
+  volumeClaimTemplates:
+    - metadata:
+        name: workspace
+      spec:
+        accessModes: [ReadWriteOnce]
+        storageClassName: sata-large
+        resources:
+          requests:
+            storage: 5Gi
+
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: pdftract-go-publish
+      tag: "{{workflow.parameters.tag}}"
+
+  templates:
+    # === Main DAG ===
+    # Orchestrates the Go SDK publish steps
+    - name: publish-go-sdk
+      dag:
+        tasks:
+          - name: clone-sdk-repo
+            template: clone-sdk-repo
+
+          - name: sync-version
+            template: sync-version
+            dependencies: [clone-sdk-repo]
+
+          - name: regenerate
+            template: regenerate
+            dependencies: [sync-version]
+            continueOn:
+              failed: true  # Optional step; failure doesn't block publish
+
+          - name: conformance
+            template: conformance
+            dependencies: [regenerate]
+
+          - name: tag-and-push
+            template: tag-and-push
+            dependencies: [conformance]
+
+          - name: warm-pkg-go-dev
+            template: warm-pkg-go-dev
+            dependencies: [tag-and-push]
+            continueOn:
+              failed: true  # Warm-up is optional; publish succeeds even if it fails
+
+    # === Clone SDK Repo ===
+    # Clones the pdftract-go repository from GitHub
+    - name: clone-sdk-repo
+      activeDeadlineSeconds: 300
+      container:
+        image: alpine:3.19
+        command: [sh, -c]
+        args:
+          - |
+            set -e
+            apk add --no-cache git
+
+            echo "Cloning pdftract-go repository..."
+            git clone --branch main \
+              "https://x-access-token:${GH_TOKEN}@github.com/jedarden/pdftract-go.git" \
+              /workspace/sdk-go
+
+            cd /workspace/sdk-go
+            echo "Cloned commit: $(git rev-parse HEAD)"
+            echo "Branch: $(git branch --show-current)"
+      env:
+        - name: GH_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: github-pat-pdftract
+              key: token
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace
+      resources:
+        requests:
+          cpu: 200m
+          memory: 512Mi
+        limits:
+          cpu: 500m
+          memory: 1Gi
+
+    # === Sync Version ===
+    # Ensures the Go module version metadata matches the binary tag.
+    # For Go modules, the version is implicit in the git tag, but we verify
+    # that any version constants in the code are consistent.
+    - name: sync-version
+      activeDeadlineSeconds: 120
+      container:
+        image: alpine:3.19
+        command: [sh, -c]
+        args:
+          - |
+            set -e
+            VERSION="{{workflow.parameters.version}}"
+            TAG="{{workflow.parameters.tag}}"
+
+            cd /workspace/sdk-go
+
+            echo "Syncing version to ${VERSION} (tag: ${TAG})"
+
+            # Check if there's a version constant to update
+            # Common patterns: const Version = "..." in version.go or similar
+            if grep -q "const Version" *.go 2>/dev/null; then
+              echo "Found version constant, checking..."
+              # If the version constant exists but doesn't match, update it
+              # This is a safety check; most Go SDKs don't have version constants
+              :
+            fi
+
+            # Verify go.mod exists
+            if [ ! -f go.mod ]; then
+              echo "ERROR: go.mod not found in pdftract-go repo"
+              exit 1
+            fi
+
+            # Extract module path
+            MODULE_PATH=$(grep "^module " go.mod | awk '{print $2}')
+            echo "Module path: ${MODULE_PATH}"
+
+            echo "Version sync complete"
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace
+      resources:
+        requests:
+          cpu: 200m
+          memory: 256Mi
+        limits:
+          cpu: 500m
+          memory: 512Mi
+
+    # === Regenerate ===
+    # Optionally re-runs the SDK generator if there have been generator changes
+    # since the last publish. This step is idempotent and safe to skip.
+    - name: regenerate
+      activeDeadlineSeconds: 600
+      container:
+        image: alpine:3.19
+        command: [sh, -c]
+        args:
+          - |
+            set -e
+            VERSION="{{workflow.parameters.version}}"
+
+            cd /workspace/sdk-go
+
+            echo "Checking if regeneration is needed..."
+
+            # Check if there's a generator script or make target
+            if [ -f Makefile ] && grep -q "generate:" Makefile; then
+              echo "Running make generate..."
+              apk add --no-cache make
+              make generate || echo "Warning: make generate failed, continuing"
+            elif [ -f scripts/generate.sh ]; then
+              echo "Running scripts/generate.sh..."
+              sh scripts/generate.sh || echo "Warning: generate.sh failed, continuing"
+            else
+              echo "No generator found; skipping regeneration"
+              echo "If the pdftract binary has new SDK changes, manual regeneration may be needed"
+            fi
+
+            echo "Regeneration step complete"
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace
+      resources:
+        requests:
+          cpu: 500m
+          memory: 1Gi
+        limits:
+          cpu: 1000m
+          memory: 2Gi
+
+    # === Conformance Tests ===
+    # Runs the Go SDK conformance test suite against the bundled binary.
+    # This step MUST pass for the publish to proceed.
+    - name: conformance
+      activeDeadlineSeconds: 1200
+      container:
+        image: golang:1.22-bookworm
+        command: [sh, -c]
+        args:
+          - |
+            set -e
+            VERSION="{{workflow.parameters.version}}"
+
+            echo "=========================================="
+            echo "Running Go SDK Conformance Tests"
+            echo "=========================================="
+
+            cd /workspace/sdk-go
+
+            # Run the conformance test suite
+            # The test should be named TestConformance or similar
+            echo "Running: go test -run Conformance -v ./..."
+            go test -run Conformance -v ./...
+
+            echo "=========================================="
+            echo "Conformance tests PASSED"
+            echo "=========================================="
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace
+      resources:
+        requests:
+          cpu: 1000m
+          memory: 2Gi
+        limits:
+          cpu: 2000m
+          memory: 4Gi
+
+    # === Tag and Push ===
+    # Creates a git tag v$VERSION and pushes it to GitHub.
+    # This is the actual publish step for Go modules.
+    - name: tag-and-push
+      activeDeadlineSeconds: 300
+      container:
+        image: alpine:3.19
+        command: [sh, -c]
+        args:
+          - |
+            set -e
+            VERSION="{{workflow.parameters.version}}"
+            TAG="{{workflow.parameters.tag}}"
+
+            echo "=========================================="
+            echo "Creating and pushing git tag v${VERSION}"
+            echo "=========================================="
+
+            cd /workspace/sdk-go
+
+            # Check if tag already exists (re-run scenario)
+            if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
+              echo "Tag v${VERSION} already exists, skipping push"
+              echo "Existing tag: $(git rev-parse v${VERSION})"
+              exit 0
+            fi
+
+            # Create the tag
+            echo "Creating tag v${VERSION}..."
+            git tag -a "v${VERSION}" -m "Release v${VERSION} (matches pdftract ${TAG})"
+
+            # Push the tag
+            echo "Pushing tag to origin..."
+            git push origin "v${VERSION}"
+
+            echo "=========================================="
+            echo "Tag v${VERSION} pushed successfully"
+            echo "=========================================="
+            echo "Go module will be available at:"
+            echo "  https://pkg.go.dev/github.com/jedarden/pdftract-go@v${VERSION}"
+      env:
+        - name: GH_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: github-pat-pdftract
+              key: token
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace
+      resources:
+        requests:
+          cpu: 200m
+          memory: 256Mi
+        limits:
+          cpu: 500m
+          memory: 512Mi
+
+    # === Warm pkg.go.dev ===
+    # Triggers pkg.go.dev indexing by pinging the Go module proxy.
+    # This is optional but speeds up availability.
+    - name: warm-pkg-go-dev
+      activeDeadlineSeconds: 60
+      container:
+        image: alpine:3.19
+        command: [sh, -c]
+        args:
+          - |
+            set -e
+            VERSION="{{workflow.parameters.version}}"
+
+            echo "Warming pkg.go.dev indexing for v${VERSION}..."
+
+            # Ping the Go module proxy to trigger indexing
+            # This typically causes pkg.go.dev to fetch within 60 seconds
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+              "https://proxy.golang.org/github.com/jedarden/pdftract-go/@v/v${VERSION}.info")
+
+            if [ "${STATUS}" = "200" ] || [ "${STATUS}" = "410" ]; then
+              echo "Module proxy ping successful (status: ${STATUS})"
+              echo "Indexing should complete within a few minutes"
+            else
+              echo "Module proxy returned status ${STATUS}"
+              echo "The tag may still be indexing; check https://pkg.go.dev later"
+            fi
+
+            echo ""
+            echo "Go module will be available at:"
+            echo "  https://pkg.go.dev/github.com/jedarden/pdftract-go@v${VERSION}"
+            echo ""
+            echo "Installation command:"
+            echo "  go get github.com/jedarden/pdftract-go@v${VERSION}"
+      resources:
+        requests:
+          cpu: 200m
+          memory: 256Mi
+        limits:
+          cpu: 500m
+          memory: 512Mi

.ci/argo-workflows/pdftract-java-publish.yaml

@@ -0,0 +1,408 @@
+# pdftract-java-publish WorkflowTemplate
+#
+# Publishes pdftract-java to Maven Central via Sonatype OSSRH staging.
+# Triggered by milestone tag after pdftract-build-binaries completes successfully.
+#
+# === Maven Central Publishing Flow ===
+# OSSRH requires a multi-step staging process:
+#   1. Clone the Java SDK repo at the tag
+#   2. Update pom.xml version to match the binary tag
+#   3. Import GPG signing key from OpenBago secret
+#   4. Run conformance tests (abort on failure)
+#   5. Build and deploy artifacts with GPG signatures to OSSRH staging
+#   6. Close and release the staging repository to Maven Central
+#
+# === Pre-release Handling ===
+# Pre-release tags (vX.Y.Z-rc.N) publish as SNAPSHOT versions (X.Y.Z-rc.N-SNAPSHOT)
+# to OSSRH snapshot repository and are NOT released to Maven Central.
+#
+# === Idempotency ===
+# OSSRH rejects duplicate version uploads. The deploy step treats "version exists"
+# as success (for snapshots) or failure (for releases — a new patch version is required).
+# Re-running on the same release tag after successful publish is a no-op.
+#
+# === GPG Signing ===
+# Maven Central requires all artifacts to be GPG-signed. The workflow imports
+# the GPG private key from the ossrh-gpg-key ExternalSecret (synced from OpenBao).
+# The passphrase is also stored in the same secret.
+#
+# === OSSRH Credentials ===
+# Uses ExternalSecret `ossrh-creds-pdftract` (synced from OpenBao).
+# Credentials: username + password for Sonatype OSSRH portal.
+#
+# === Central Sync Delay ===
+# After release-to-Central, there is a ~10 minute delay before the artifact
+# appears on search.maven.org due to Central's sync process.
+#
+# Bead: pdftract-2wif9
+# Plan section: SDK Architecture / Per-SDK Release Channels, line 3594
+# ADR-009: All CI runs on iad-ci; GitHub Actions are disabled.
+#
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: pdftract-java-publish
+  namespace: argo-workflows
+  labels:
+    app.kubernetes.io/name: pdftract-java-publish
+    app.kubernetes.io/component: ci
+    app.kubernetes.io/part-of: pdftract
+spec:
+  entrypoint: publish-java
+  serviceAccountName: argo-workflow
+
+  podGC: OnPodCompletion
+
+  ttlSecondsAfterFinished:
+    success: 1800
+    failure: 7200
+
+  arguments:
+    parameters:
+      - name: tag
+        value: ""
+        description: "Git tag triggering the publish (e.g., v0.3.0 or v0.3.0-rc.1)"
+      - name: dry_run
+        value: "false"
+        description: "Set to 'true' for testing -- skips actual publish"
+
+  volumes:
+    - name: maven-home
+      emptyDir: {}
+    - name: gpg-home
+      emptyDir: {}
+
+  podMetadata:
+    labels:
+      app.kubernetes.io/name: pdftract-java-publish
+      tag: "{{workflow.parameters.tag}}"
+
+  templates:
+    - name: publish-java
+      dag:
+        tasks:
+          - name: clone-sdk-repo
+            template: clone-sdk-repo
+
+          - name: sync-version
+            dependencies: [clone-sdk-repo]
+            template: sync-version
+
+          - name: import-gpg-key
+            template: import-gpg-key
+
+          - name: conformance
+            dependencies: [sync-version, import-gpg-key]
+            template: conformance
+
+          - name: build-and-sign
+            dependencies: [conformance]
+            template: build-and-sign
+            arguments:
+              parameters:
+                - name: is_snapshot
+                  value: "{{tasks.sync-version.outputs.parameters.is_snapshot}}"
+
+          - name: close-and-release-staging
+            dependencies: [build-and-sign]
+            template: close-and-release-staging
+            when: "{{tasks.sync-version.outputs.parameters.is_snapshot}} == false"
+
+    - name: clone-sdk-repo
+      activeDeadlineSeconds: 600
+      script:
+        image: alpine:3.19
+        command: [sh, -c]
+        source: |
+          set -e
+
+          apk add --no-cache git
+
+          git clone --depth 1 --branch main \
+            "https://github.com/jedarden/pdftract-java.git" /workspace
+
+          cd /workspace
+
+          echo "Cloned pdftract-java repository"
+          git log -1 --oneline
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+        resources:
+          requests:
+            cpu: 200m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+      outputs:
+        artifacts:
+          - name: workspace
+            path: /workspace
+
+    - name: sync-version
+      inputs:
+        artifacts:
+          - name: workspace
+            from: "{{tasks.clone-sdk-repo.outputs.artifacts.workspace}}"
+            path: /workspace
+      activeDeadlineSeconds: 300
+      script:
+        image: maven:3.9-eclipse-temurin-17
+        command: [bash, -c]
+        source: |
+          set -e
+
+          TAG="{{workflow.parameters.tag}}"
+          cd /workspace
+
+          # Extract version from tag (strip 'v' prefix)
+          VERSION="${TAG#v}"
+
+          # Detect pre-release tags (e.g., v0.3.0-rc.1)
+          IS_SNAPSHOT="false"
+          if echo "$VERSION" | grep -qE '-rc\.[0-9]+'; then
+            # Convert to SNAPSHOT version: 0.3.0-rc.1 -> 0.3.0-rc.1-SNAPSHOT
+            VERSION="${VERSION}-SNAPSHOT"
+            IS_SNAPSHOT="true"
+            echo "Pre-release tag detected: publishing as SNAPSHOT ($VERSION)"
+          else
+            echo "Release tag detected: publishing to Maven Central ($VERSION)"
+          fi
+
+          # Update pom.xml version
+          sed -i "s/<version>.*<\/version> <relativePath>..<\/relativePath>/<version>${VERSION}<\/version> <relativePath>..<\/relativePath>/" pom.xml
+          sed -i "0,/<version>.*<\/version>/s/<version>.*<\/version>/<version>${VERSION}<\/version>/" pom.xml
+
+          echo "Updated pom.xml to version $VERSION"
+
+          # Verify the change
+          grep -A1 "<groupId>com.jedarden</groupId>" pom.xml | grep "<version>"
+
+          # Output parameters for downstream tasks
+          echo "is_snapshot=${IS_SNAPSHOT}" > /tmp/outputs
+          echo "version=${VERSION}" >> /tmp/outputs
+
+          cat /tmp/outputs
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+        resources:
+          requests:
+            cpu: 500m
+            memory: 1Gi
+          limits:
+            cpu: 1000m
+            memory: 2Gi
+      outputs:
+        parameters:
+          - name: is_snapshot
+            valueFrom:
+              path: /tmp/outputs/is_snapshot
+          - name: version
+            valueFrom:
+              path: /tmp/outputs/version
+        artifacts:
+          - name: workspace
+            path: /workspace
+
+    - name: import-gpg-key
+      activeDeadlineSeconds: 300
+      script:
+        image: maven:3.9-eclipse-temurin-17
+        command: [bash, -c]
+        source: |
+          set -e
+
+          echo "Importing GPG key for Maven Central signing..."
+
+          # Import GPG private key from secret
+          gpg --batch --import < /secrets/gpg-private-key.asc 2>&1 | head -20
+
+          # Verify import
+          gpg --list-keys
+
+          echo "GPG key imported successfully"
+        volumeMounts:
+          - name: gpg-home
+            mountPath: /root/.gnupg
+        resources:
+          requests:
+            cpu: 200m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+      secrets:
+        - name: gpg-private-key
+          secretName: ossrh-gpg-key
+          secretKey: private-key
+
+    - name: conformance
+      inputs:
+        artifacts:
+          - name: workspace
+            from: "{{tasks.sync-version.outputs.artifacts.workspace}}"
+            path: /workspace
+      activeDeadlineSeconds: 1800
+      retryStrategy:
+        limit: 1
+        retryPolicy: OnError
+      script:
+        image: maven:3.9-eclipse-temurin-17
+        command: [mvn]
+        args:
+          - test
+          - -Dtest=ConformanceTest
+          - -q
+        workingDir: /workspace
+        env:
+          - name: MAVEN_OPTS
+            value: "-Xmx2g"
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+          - name: maven-home
+            mountPath: /root/.m2
+        resources:
+          requests:
+            cpu: 1000m
+            memory: 2Gi
+          limits:
+            cpu: 2000m
+            memory: 4Gi
+
+    - name: build-and-sign
+      inputs:
+        parameters:
+          - name: is_snapshot
+        artifacts:
+          - name: workspace
+            from: "{{tasks.conformance.outputs.artifacts.workspace}}"
+            path: /workspace
+      activeDeadlineSeconds: 1800
+      retryStrategy:
+        limit: 2
+        retryPolicy: OnError
+      script:
+        image: maven:3.9-eclipse-temurin-17
+        command: [bash, -c]
+        source: |
+          set -e
+
+          IS_SNAPSHOT="{{inputs.parameters.is_snapshot}}"
+          DRY_RUN="{{workflow.parameters.dry_run}}"
+
+          cd /workspace
+
+          if [ "$DRY_RUN" = "true" ]; then
+            echo "[DRY RUN] Would build and sign artifacts"
+            mvn -B clean deploy -P release -DskipTests -Dgpg.skip=true
+            exit 0
+          fi
+
+          # Build, sign, and deploy to OSSRH
+          # The 'release' profile in pom.xml configures:
+          # - maven-gpg-plugin (signs all artifacts)
+          # - maven-source-plugin (attaches sources jar)
+          # - maven-javadoc-plugin (attaches javadoc jar)
+          # - nexus-staging-maven-plugin (OSSRH upload)
+
+          if [ "$IS_SNAPSHOT" = "true" ]; then
+            echo "Deploying SNAPSHOT to OSSRH snapshots repository..."
+            mvn -B clean deploy -P release -DskipTests
+          else
+            echo "Building and signing artifacts for OSSRH staging..."
+            # Deploy to staging (auto-close is disabled in nexus-staging-maven-plugin)
+            # We close and release in a separate step
+            mvn -B clean deploy -P release -DskipTests \
+              -Dnexus-staging.autoReleaseAfterClose=false
+          fi
+
+          echo "Build and sign complete"
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+          - name: maven-home
+            mountPath: /root/.m2
+          - name: gpg-home
+            mountPath: /root/.gnupg
+        env:
+          - name: MAVEN_OPTS
+            value: "-Xmx2g"
+          - name: OSSRH_USERNAME
+            valueFrom:
+              secretKeyRef:
+                name: ossrh-creds-pdftract
+                key: username
+          - name: OSSRH_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: ossrh-creds-pdftract
+                key: password
+          - name: GPG_TTY
+            value: "/dev/null"  # Non-interactive GPG
+        resources:
+          requests:
+            cpu: 1000m
+            memory: 2Gi
+          limits:
+            cpu: 2000m
+            memory: 4Gi
+
+    - name: close-and-release-staging
+      inputs:
+        artifacts:
+          - name: workspace
+            from: "{{tasks.build-and-sign.outputs.artifacts.workspace}}"
+            path: /workspace
+      activeDeadlineSeconds: 1800
+      retryStrategy:
+        limit: 2
+        retryPolicy: OnError
+      script:
+        image: maven:3.9-eclipse-temurin-17
+        command: [bash, -c]
+        source: |
+          set -e
+
+          cd /workspace
+
+          echo "Closing and releasing OSSRH staging repository..."
+
+          # Use nexus-staging-maven-plugin to close and release
+          # This invokes the Sonatype OSSRH REST API to:
+          # 1. Close the staging repository (validates all artifacts)
+          # 2. Release the staging repository to Maven Central
+          mvn -B nexus-staging:close nexus-staging:release \
+            -DserverId=ossrh \
+            -DnexusUrl=https://s01.oss.sonatype.org/ \
+            -DautoReleaseAfterClose=true
+
+          echo "Staging repository closed and released to Maven Central"
+          echo "Artifact will appear on search.maven.org within ~10 minutes"
+        volumeMounts:
+          - name: workspace
+            mountPath: /workspace
+          - name: maven-home
+            mountPath: /root/.m2
+        env:
+          - name: MAVEN_OPTS
+            value: "-Xmx2g"
+          - name: OSSRH_USERNAME
+            valueFrom:
+              secretKeyRef:
+                name: ossrh-creds-pdftract
+                key: username
+          - name: OSSRH_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: ossrh-creds-pdftract
+                key: password
+        resources:
+          requests:
+            cpu: 500m
+            memory: 1Gi
+          limits:
+            cpu: 1000m
+            memory: 2Gi

notes/bf-4ygdw.md

@@ -0,0 +1,54 @@
+# bf-4ygdw: Go and Java Publishing Workflows
+
+## Summary
+Added two Argo WorkflowTemplates for Go and Java SDK publishing to match existing PHP/Ruby/Swift publish patterns.
+
+## Work Completed
+
+### 1. Go Publishing Workflow (`pdftract-go-publish.yaml`)
+- **Source**: Copied from existing declarative-config workflow
+- **Target**: `github.com/jedarden/pdftract-go` via git tag
+- **Mechanism**: 
+  - Clones Go SDK repo
+  - Syncs module version
+  - Runs conformance tests with `go test -run Conformance`
+  - Creates git tag `v$VERSION` and pushes
+  - Triggers pkg.go.dev indexing via proxy ping
+- **Secrets**: `github-pat-pdftract`
+- **Idempotent**: Detects existing tags and skips re-push
+
+### 2. Java Publishing Workflow (`pdftract-java-publish.yaml`)
+- **Source**: Copied from existing declarative-config workflow
+- **Target**: Maven Central via Sonatype OSSRH
+- **Mechanism**:
+  - Clones Java SDK repo
+  - Updates `pom.xml` version
+  - Imports GPG signing key from OpenBago secret
+  - Runs conformance tests (abort on failure)
+  - Builds and signs artifacts with Maven GPG plugin
+  - Deploys to OSSRH staging repository
+  - Closes and releases staging repository to Maven Central
+- **Secrets**: 
+  - `ossrh-creds-pdftract` (username/password)
+  - `ossrh-gpg-key` (GPG private key for signing)
+- **Pre-release support**: RC tags publish as SNAPSHOT versions
+- **Maven Central requirements**: Fully compliant with GPG signing and OSSRH staging flow
+
+### 3. File Locations
+- **Added**: `/home/coding/pdftract/.ci/argo-workflows/pdftract-go-publish.yaml`
+- **Added**: `/home/coding/pdftract/.ci/argo-workflows/pdftract-java-publish.yaml`
+- **Sync target**: ArgoCD syncs to `jedarden/declarative-config/k8s/iad-ci/argo-workflows/`
+
+## Acceptance Criteria Status
+- ✅ Both YAML files exist in `.ci/argo-workflows/`
+- ✅ Workflows follow existing PHP/Ruby publish patterns
+- ✅ Java workflow follows Maven Central GPG signing requirements
+- ✅ Both workflows reference plan sections and ADR-009
+- ✅ ArgoCD will sync templates to declarative-config (existing sync infrastructure)
+
+## References
+- Plan lines 3400–3413 (Release Engineering)
+- Plan line 3571 (Go SDK publish channel)
+- Plan line 3594 (Java SDK publish channel)
+- ADR-009 (Argo Workflows on iad-ci only)
+- Parent bead: bf-5o8cg