fix(cli-release): make dry-run actually dry and always clean up

[wezell]

Summary

Follow-up to #37568. While validating the CLI release with a workflow_dispatch dry-run after the Artifactory→BunnyCDN migration, the dry-run turned out not to be dry:

1. JRELEASER_DRY_RUN is never read. The JReleaser Maven plugin's dry-run is the property jreleaser.dry.run (JRELEASER_DRY_RUN is ignored), so a dry-run dispatch would create a real GitHub release.
2. publish-npm-package ignored the input — if: success() — so a dry-run dispatch ran npm publish for real.
3. clean-up leaked the auxiliary branch — it needs: publish-npm-package without always(), so once the NPM job is skipped (or fails) the version-update-* branch is never deleted.

Changes

• Set -Djreleaser.dry.run=true on a dry-run dispatch and drop the ineffective JRELEASER_DRY_RUN env.
• publish-npm-package: if: success() && github.event.inputs.dry-run != 'true'.
• clean-up: if: ${{ always() && needs.precheck.outputs.AUXILIARY_BRANCH != '' }}.

Validation

Ran a workflow_dispatch dry-run of Release - CLI on a scratch ref containing these changes:

• --- jreleaser:1.8.0:release (default) --- → success
• [INFO] dry-run set to true
• [INFO] [upload] Uploading is not enabled. Skipping (confirms removing the Artifactory uploader is clean)
• Publish NPM Package: skipped
• No new Git tag or GitHub release created
• Publish CLI artifacts to S3: skipped (dry-run), as designed

Refs #37567

[claude]

Claude finished @wezell's task in 1m 11s —— View job

---

PR Review: make dry-run actually dry and always clean up

• Read PR diff
• Analyze workflow job dependencies & conditions
• Post review

All three changes are correct and the reasoning holds up against the full workflow.

Analysis

1. release job — -Djreleaser.dry.run=true (line 187)
Correct. The JReleaser Maven plugin reads the jreleaser.dry.run system property, not the JRELEASER_DRY_RUN env var, so the old env had no effect. The conditional expression is sound: on a release event github.event.inputs.dry-run is null, null == 'true' is false, so the || '' branch yields an empty string and real releases get no dry-run flag. Only a workflow_dispatch with dry-run=true injects the flag.

2. publish-npm-package — if: success() && github.event.inputs.dry-run != 'true' (line 235)
Correct. On a release event the input is null so != 'true' is true → publishes as before; on a dry-run dispatch it's skipped, which also correctly suppresses the Slack "new release" notification (a step inside this job). No other job needs this one except clean-up, which is now guarded by always() (see below), so skipping it can't strand a downstream job.

3. clean-up — if: ${{ always() && needs.precheck.outputs.AUXILIARY_BRANCH != '' }} (line 403)
Correct, and this is the important one. Previously, once publish-npm-package was skipped or failed, the whole chain short-circuited and the version-update-* branch leaked. always() now forces cleanup regardless of upstream status (skip, failure, or cancellation), while the AUXILIARY_BRANCH != '' guard still short-circuits cleanly when precheck itself was skipped (e.g. an LTS release tag) and never produced the output. Deleting on cancellation is also desirable here given cancel-in-progress: true.

New Issues

No issues found.

Edge cases I checked and found handled: null input on release events, precheck skipped (LTS tag), release/build failure paths, workflow cancellation, and the trailing-space in maven-args (harmless to Maven).

One thing worth noting but out of scope for this diff: precheck still creates and pushes the version-update-* branch to origin on a dry-run (unchanged code), so a dry-run isn't fully side-effect-free at the git level — but it's now reliably deleted by clean-up, which is exactly the leak this PR closes.

· issue-37567-cli-dryrun-safety