[sergej-koscejev]

Summary

Replace TeamCity publishing and commit-derived plugin versions with explicit, independently versioned GitHub releases.

push <project>-<version> tag
  → check tag matches gradle.properties and is not a snapshot
  → build selected project
  → publish to itemis releases and GitHub Packages
  → create GitHub Release

push master or v1.x
  → pass CI
  → publish projects with -SNAPSHOT versions to itemis snapshots only

Remove .teamcity/ and the TeamCity build-number task. Keep each project's version in its own gradle.properties, with manual version bumps. Document the process in RELEASING.md.

Use the organization secrets ARTIFACTS_ITEMIS_CLOUD_USER and ARTIFACTS_ITEMIS_CLOUD_PW, plus GITHUB_TOKEN for GitHub publishing. Pin actions, disable checkout credential persistence and release caching, and set job timeouts.

Evidence

• Before: TeamCity published the main plugin with a branch/commit-derived version; GitHub Actions only built it.
  After: matching release tags pass validation; mismatched tags and snapshot release versions fail for both projects. Checked that release and snapshot versions select the intended repositories, with GitHub Packages excluded for snapshots.
• actionlint 1.7.12 passes; zizmor 1.31.1 passes online audits under its default profile.
• Helper build passes. Maven publication metadata generation passes and uses 1.32.0-SNAPSHOT.
• ./gradlew check: all 47 tests pass; API and plugin validation pass. No artifacts were published during validation.

Merge Danger

Blast Radius: Publishing

Release and snapshot publishing require successful builds. Existing TeamCity server jobs may need to be disabled separately from removing the repository configuration.