fix(ci): fix environment in publish workflow

.github/workflows/minestom-ci.yml

@@ -6,19 +6,76 @@ on:
 
 concurrency: "gradle-snapshot-${{ github.ref }}"
 
-env:
-  ORG_GRADLE_PROJECT_signingKeyId: "${{ secrets.SIGNING_KEY_ID }}"
-  ORG_GRADLE_PROJECT_signingKey: "${{ secrets.SIGNING_KEY }}"
-  ORG_GRADLE_PROJECT_signingPassword: "${{ secrets.SIGNING_PASSWORD }}"
+permissions:
+  contents: read
 
 jobs:
-  snapshot:
-    name: "Snapshot"
-    uses: HyperaDev/actions/.github/workflows/gradle-snapshot.yml@main
-    with:
-      java_version: "21"
-    secrets:
-      HYPERA_SNAPSHOTS_USERNAME: "${{ secrets.HYPERA_SNAPSHOTS_USERNAME }}"
-      HYPERA_SNAPSHOTS_PASSWORD: "${{ secrets.HYPERA_SNAPSHOTS_PASSWORD }}"
-      SONATYPE_USERNAME: "${{ secrets.SONATYPE_USERNAME }}"
-      SONATYPE_PASSWORD: "${{ secrets.SONATYPE_PASSWORD }}"
+  publish:
+    name: "Publish"
+    runs-on: "ubuntu-latest"
+    environment:
+      name: "snapshot"
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          fetch-depth: 0
+          submodules: true
+
+      - name: "Validate Gradle wrapper"
+        uses: gradle/actions/wrapper-validation@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3.5.0
+
+      - name: "Setup JDK 21"
+        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: "Setup Gradle"
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3.5.0
+        with:
+          gradle-version: "wrapper"
+
+      - name: "Validate version"
+        run: |
+          VERSION="$(./gradlew properties | awk '/^version:/ { print $2; }')"
+          if ! echo "$VERSION" | grep -q 'SNAPSHOT'; then
+            echo "Release version detected, refusing to publish..."
+            exit 1
+          fi
+          echo "Snapshot version detected"
+
+      - name: "Publish artifacts"
+        run: ./gradlew publish
+        env:
+          ORG_GRADLE_PROJECT_signingKeyId: "${{ secrets.SIGNING_KEY_ID }}"
+          ORG_GRADLE_PROJECT_signingKey: "${{ secrets.SIGNING_KEY }}"
+          ORG_GRADLE_PROJECT_signingPassword: "${{ secrets.SIGNING_PASSWORD }}"
+          ORG_GRADLE_PROJECT_sonatypeUsername: "${{ secrets.SONATYPE_USERNAME }}"
+          ORG_GRADLE_PROJECT_sonatypePassword: "${{ secrets.SONATYPE_PASSWORD }}"
+          ORG_GRADLE_PROJECT_hyperaSnapshotsUsername: "${{ secrets.HYPERA_SNAPSHOTS_USERNAME }}"
+          ORG_GRADLE_PROJECT_hyperaSnapshotsPassword: "${{ secrets.HYPERA_SNAPSHOTS_PASSWORD }}"
+
+  dependency-graph:
+    name: "Dependency Graph"
+    runs-on: "ubuntu-latest"
+    permissions:
+      contents: write
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          fetch-depth: 0
+          submodules: true
+
+      - name: "Setup JDK 21"
+        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: "Validate Gradle wrapper"
+        uses: gradle/actions/wrapper-validation@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3.5.0
+
+      - name: "Generate and submit dependency graph"
+        uses: gradle/actions/dependency-submission@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3.5.0