[ismisepaul]

Closes #949

Changes

• pom.xml: 3.1.0-SNAPSHOT → 4.0.0-SNAPSHOT. 3.1 shipped in 2018. The Jakarta migration (Migrate from javax.* (Java EE) to jakarta.* (Jakarta EE 9+) to enable Spring 6 / modern stack #861) needs Tomcat 10.1+ and changes the SAML configuration, so it's a major version bump.
• release.yml:
  • Also triggers on plain X.Y.Z tag pushes ([0-9]+.[0-9]+.[0-9]+).
  • On tag pushes, a new first step fails the release if the tag doesn't match the pom.xml version (checked with maven-help-plugin:3.5.1:evaluate).
  • Docker tags: branch pushes still publish :dev / :master. A release tag such as 4.1.0 publishes :4.1.0, :4.1, :4 and :latest.
• Docs: new docs/releasing.md covering the version format, the tag rules and the release steps. CONTRIBUTING.md links to it, and AGENTS.md has a short versioning section.

Already in place (repo settings, not part of this diff)

Tag rulesets:

• tags: semver format: new tags must match ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$
• tags: restrict creation: only admins can create tags
• tags: block deletion & moves: tags can't be deleted or moved

The legacy tags 2.3, 2.4, v3.0 and v3.1 are left as they are.

Known limitation

The release workflow itself is currently broken (#950). This PR doesn't fix that, so tag-triggered releases won't publish until #950 is resolved.

Testing

• actionlint passes on release.yml.
• I ran the version check locally: tag 4.0.0 against pom 4.0.0-SNAPSHOT fails with the error annotation, and tag 4.0.0 against pom 4.0.0 passes.
• mvn test -B: 169 tests, 0 failures, 2 skipped.
• I tested the tag regex against SemVer 2.0.0 cases. It accepts 4.0.0, 4.0.1 and 4.1.0, and rejects v4.0.0, 4.0, 04.0.0, 4.0.0-rc.1 and 4.0.0+build.1.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Existing workflow failures tracked in #950 prevent end-to-end validation of the new tag-triggered publishing path, so human review is needed.

No open issues 🎉

What changed in this PR

Adopts Semantic Versioning for Security Shepherd and starts 4.0.0-SNAPSHOT, reflecting the breaking Jakarta migration planned for the next major release.

Changes:

• Updates the Maven project version to 4.0.0-SNAPSHOT.
• Adds release-tag triggers, tag-to-POM version validation, and versioned Docker image tags.
• Documents versioning rules and the release process.

File	Description
pom.xml	Sets the development version to 4.0.0-SNAPSHOT.
docs/​releasing.md	Documents version formats, tag restrictions, and release steps.
CONTRIBUTING.md	Summarizes versioning policy and links to release instructions.
AGENTS.md	Adds versioning and release guidance for coding agents.
.github/​workflows/​release.yml	Adds release-tag handling, version validation, and Docker tag generation.

_{Review effort: Balanced}