release: guard Central the way pub.dev and crates.io are, and let dispatch work

Both fall out of the org-level Maven secrets existing. The Central job used to
warn and skip because no signing key was configured; now it will actually run,
and its first act on a re-run would be to deploy a version Central already has,
which Central never allows. It now asks first, like the other two registries.

`workflow_dispatch` was in `on:` as the way back from a tag whose event was never
delivered, but `verify` read the version from `${GITHUB_REF_NAME#v}` — on a
manual run that is the branch, so it computed `main` and failed the manifest
check. It now falls back to the core's own version, which is the reference
`check_versions.sh` already uses when called without an argument.

Checked against Central: 0.1.0 reports as present and skips, an absent version
falls through to the deploy.

Author: anidotnet

.github/workflows/release.yml

@@ -46,7 +46,17 @@ jobs:
       - id: check
         shell: bash
         run: |
-          version="${GITHUB_REF_NAME#v}"
+          # `workflow_dispatch` is in `on:` as the way back from a tag whose
+          # event was never delivered, and it has no tag to read. Fall back to
+          # the core's own version, which is the reference `check_versions.sh`
+          # uses when it is called without an argument.
+          if [ "${GITHUB_REF_TYPE:-}" = tag ]; then
+            version="${GITHUB_REF_NAME#v}"
+          else
+            version="$(sed -n 's/^version: *//p' \
+              dart/dbinspect_bridge/pubspec.yaml | head -1)"
+            echo "::notice::not a tag, releasing the manifest version $version"
+          fi
           tool/check_versions.sh "$version"
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
@@ -157,8 +167,25 @@ jobs:
           printf '%s' "$MAVEN_GPG_PRIVATE_KEY" | gpg --batch --import
           echo "ready=true" >> "$GITHUB_OUTPUT"
 
+      # Central never lets a version be replaced, so a re-run — or a release
+      # resumed after one registry failed — must not attempt one that is up.
+      # The same rule the pub.dev and crates.io jobs follow.
+      - name: Is it already on Central?
+        id: central
+        env:
+          VERSION: ${{ needs.verify.outputs.version }}
+        run: |
+          set -euo pipefail
+          base=https://repo1.maven.org/maven2/org/dizitart/dbinspect-bridge
+          if curl -sfo /dev/null "$base/$VERSION/dbinspect-bridge-$VERSION.pom"; then
+            echo "dbinspect-bridge $VERSION is already on Maven Central"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Set the release version
-        if: steps.gpg.outputs.ready == 'true'
+        if: steps.gpg.outputs.ready == 'true' && steps.central.outputs.skip == 'false'
         working-directory: jvm/dbinspect-bridge
         run: |
           mvn -B -ntp org.codehaus.mojo:versions-maven-plugin:2.21.0:set \
@@ -169,7 +196,7 @@ jobs:
       # The settings file is written here rather than committed because the two
       # values in it are secrets.
       - name: Deploy
-        if: steps.gpg.outputs.ready == 'true'
+        if: steps.gpg.outputs.ready == 'true' && steps.central.outputs.skip == 'false'
         working-directory: jvm/dbinspect-bridge
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}