chore: update release plz (#1362)

Signed-off-by: Todd Baert <[email protected]>

Author: toddbaert

.github/workflows/release-please.yml

@@ -5,23 +5,36 @@ on:
 name: Run Release Please
 jobs:
   release-please:
-    environment: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # for googleapis/release-please-action to create release commit
+      pull-requests: write # for googleapis/release-please-action to create release PR
+      issues: write # for googleapis/release-please-action to create labels
 
     # Release-please creates a PR that tracks all changes
     steps:
       - uses: googleapis/release-please-action@v4
         id: release
         with:
           token: ${{secrets.RELEASE_PLEASE_ACTION_TOKEN}}
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      release_tag_name: ${{ steps.release.outputs.tag_name }}
 
+  publish:
+    environment: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    needs: release-please
+    if: ${{ fromJSON(needs.release-please.outputs.release_created || false) }}
+
+    steps:
       # The logic below handles the maven publication:
       - name: Checkout Repository
-        if: ${{ steps.release.outputs.releases_created }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up JDK 21
-        if: ${{ steps.release.outputs.releases_created }}
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
         with:
           java-version: '21'
@@ -32,7 +45,6 @@ jobs:
           server-password: OSSRH_PASSWORD
 
       - name: Cache local Maven repository
-        if: ${{ steps.release.outputs.releases_created }}
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
           path: ~/.m2/repository
@@ -49,7 +61,6 @@ jobs:
 
       # Release Please has already incremented versions and published tags, so we just need to publish (skip tests).
       - name: Maven Verify Deploy -DskipTests
-        if: ${{ steps.release.outputs.releases_created }}
         # The nexus-staging-maven-plugin doesn't follow maven conventions. It stages all the projects with the last submodule: https://help.sonatype.com/repomanager2/staging-releases/configuring-your-project-for-deployment
         # This means there's no way to skip publishing of a particular module in a multi-module build, so we iterate over each module and publish them individually,
         # letting exists-maven-plugin skip the nexus-staging-maven-plugin's entire deploy goal if the artifact exists.