Index: /trunk/.github/workflows/ant.yml
===================================================================
--- /trunk/.github/workflows/ant.yml	(revision 17372)
+++ /trunk/.github/workflows/ant.yml	(revision 17373)
@@ -15,5 +15,49 @@
 
 jobs:
+  createrelease:
+    name: Create Release
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    outputs: 
+      upload_url: ${{ steps.create_release.outputs.upload_url }}
+      josm_revision: ${{ steps.create_revision.outputs.josm_revision }}
+      josm_prerelease: ${{ steps.create_revision.outputs.josm_prerelease }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 32
+      - name: Set revision env variable
+        id: create_revision
+        # grab josm revision from last git-svn-id
+        run: |
+          josm_revision="$(git log -1 --grep 'git-svn-id: https://josm.openstreetmap.de/svn/trunk@' --pretty=format:%B | tail -1 | sed -n 's%git-svn-id: https://josm.openstreetmap.de/svn/trunk@\([0-9]*\) [-0-9a-f]*%\1%p')"
+          if [[ "$josm_revision" == "$(curl --silent https://josm.openstreetmap.de/tested)" ]]; then
+            sed -i '/Is-Local-Build/d' resources/REVISION
+            echo "josm_prerelease=false" >> $GITHUB_ENV
+            echo "::set-output name=josm_prerelease::false"
+            echo "josm_release=$josm_revision-tested" >> $GITHUB_ENV
+          else
+            echo "josm_prerelease=true" >> $GITHUB_ENV
+            echo "::set-output name=josm_prerelease::true"
+            echo "josm_release=$josm_revision" >> $GITHUB_ENV
+          fi
+          echo "josm_revision=$josm_revision" >> $GITHUB_ENV
+          echo "::set-output name=josm_revision::$josm_revision"
+      - name: Create release
+        id: create_release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
+        with:
+          tag_name: ${{ env.josm_release }}
+          release_name: JOSM.app release ${{ env.josm_release }}
+          body: |
+            JOSM.app release ${{ env.josm_release }}
+          draft: false
+          prerelease: ${{ env.josm_prerelease }}
   build:
+    needs: createrelease
     runs-on: ${{ matrix.os }}
     env:
@@ -31,6 +75,4 @@
           - java: 11
             os: macos-latest
-          - java: 16-ea
-            os: macos-latest
           - headless: "false"
             os: macos-latest
@@ -42,5 +84,5 @@
         uses: actions/checkout@v2
         with:
-          fetch-depth: 128
+          fetch-depth: 32
       - name: Cache
         uses: actions/cache@v2.0.0
@@ -49,4 +91,5 @@
             ~/.ivy2/cache/
             ~/work/josm/josm/tools/
+            build-tools-cache/
           key: ${{ runner.os }}-ivy2-${{ hashFiles('ivy.xml') }}
       - name: Setup java
@@ -55,22 +98,48 @@
           java-version: ${{ matrix.java }}
       - name: Install ant ${{ env.ANT_HOME }} and junit ${{ env.junit_platform_version }}
-        # Todo: cache ant and junit, saves 12 seconds.
         run: |
-          curl -s https://downloads.apache.org/ant/binaries/${{ env.ANT_HOME }}-bin.tar.gz | tar -xz
-          curl -o ${{ env.ANT_HOME }}/lib/junit-platform-console-standalone-${{ env.junit_platform_version }}.jar  "https://repo1.maven.org/maven2/org/junit/platform/junit-platform-console-standalone/${{ env.junit_platform_version }}/junit-platform-console-standalone-${{ env.junit_platform_version }}.jar"
+          mkdir -p build-tools-cache/
+          cd build-tools-cache/
+          if [ ! -f ${{ env.ANT_HOME }}-bin.tar.gz ]; then
+            curl -o ${{ env.ANT_HOME }}-bin.tar.gz https://downloads.apache.org/ant/binaries/${{ env.ANT_HOME }}-bin.tar.gz
+          fi
+          if [ ! -f junit-platform-console-standalone-${{ env.junit_platform_version }}.jar ]; then
+            curl -o junit-platform-console-standalone-${{ env.junit_platform_version }}.jar https://repo1.maven.org/maven2/org/junit/platform/junit-platform-console-standalone/${{ env.junit_platform_version }}/junit-platform-console-standalone-${{ env.junit_platform_version }}.jar
+          fi
+          cd ..
+          tar zxf build-tools-cache/${{ env.ANT_HOME }}-bin.tar.gz
+          cp build-tools-cache/junit-platform-console-standalone-${{ env.junit_platform_version }}.jar ${{ env.ANT_HOME }}/lib/junit-platform-console-standalone-${{ env.junit_platform_version }}.jar
       - name: Print ant version, expecting ${{ env.ANT_HOME }}
         run: ${{ env.ANT_HOME }}/bin/ant -version
-      - name: Set revision env variable
+      - name: Optimise images
+        if: ${{ runner.os == 'macos' && always() }}
         run: |
-          ant create-revision
-          josm_revision=`awk '/Revision/{print $2}' resources/REVISION`
-          if [[ "$josm_revision" == `curl --silent https://josm.openstreetmap.de/tested` ]]; then
-            sed -i .bak '/Is-Local-Build/d' resources/REVISION
-            echo "josm_prerelease=false" >> $GITHUB_ENV
+          brew cask install imageoptim
+          defaults write net.pornel.ImageOptim SvgoEnabled 1
+          defaults write net.pornel.ImageOptim PngCrush2Enabled 1
+          defaults write net.pornel.ImageOptim PngOutEnabled 1
+          /Applications/ImageOptim.app/Contents/MacOS/ImageOptim resources/images
+      - name: Build with Ant
+        # Disables errorprone for Java 16
+        # See https://github.com/google/error-prone/issues/1872
+        run: |
+          if [[ "x${{ matrix.java }}x" =~ x1[6-9](-ea)?x ]]; then
+            ${{ env.ANT_HOME }}/bin/ant -DnoErrorProne dist
           else
-            echo "josm_prerelease=true" >> $GITHUB_ENV
+            ${{ env.ANT_HOME }}/bin/ant dist
           fi
-          echo "josm_revision=$josm_revision" >> $GITHUB_ENV
-      - name: Build with Ant, headless ${{ matrix.headless }}
+      - name: Upload jar
+        if: ${{ always() && matrix.headless }}
+        id: upload-jar
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ needs.createrelease.outputs.upload_url }} # This pulls from the CREATE RELEASE job above, referencing its ID to get its outputs object, which include a `upload_url`.
+          asset_path: dist/josm-custom.jar
+          asset_name: JOSM-${{ runner.os}}-java${{ matrix.java }}-${{ needs.createrelease.outputs.josm_revision }}.jar
+          asset_content_type: application/java-archive
+      - name: Test with Ant, headless ${{ matrix.headless }}
+        if: ${{ needs.createrelease.outputs.josm_prerelease }}
         run: |
           ANT="${{ env.ANT_HOME }}/bin/ant -DnoJavaFX=true test-unit-hardfail"
@@ -87,14 +156,6 @@
         uses: actions/upload-artifact@v2
         with:
-          name: Ant reports for JOSM ${{ env.josm_revision }} on java ${{ matrix.java }} on ${{ matrix.os }} with headless=${{ matrix.headless }}
+          name: Ant reports for JOSM ${{ needs.createrelease.outputs.josm_revision }} on java ${{ matrix.java }} on ${{ matrix.os }} with headless=${{ matrix.headless }}
           path: test/report/*.txt
-      - name: Optimise images
-        if: ${{ runner.os == 'macos' && always() }}
-        run: |
-          brew cask install imageoptim
-          defaults write net.pornel.ImageOptim SvgoEnabled 1
-          defaults write net.pornel.ImageOptim PngCrush2Enabled 1
-          defaults write net.pornel.ImageOptim PngOutEnabled 1
-          /Applications/ImageOptim.app/Contents/MacOS/ImageOptim resources/images
       - name: Build and package for macOS
         if: ${{ runner.os == 'macos' && always() }}
@@ -104,19 +165,5 @@
           APPLE_ID_PW: ${{ secrets.APPLE_ID_PW }}
         run: |
-          $ANT_HOME/bin/ant -DnoErrorProne dist
-          ./native/macosx/macos-jpackage.sh ${{ env.josm_revision }}
-      - name: Create macOS release
-        if: ${{ runner.os == 'macos' && always() }}
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
-        with:
-          tag_name: ${{ env.josm_revision }}
-          release_name: JOSM.app release ${{ env.josm_revision }}
-          body: |
-            JOSM.app release ${{ env.josm_revision }}
-          draft: false
-          prerelease: ${{ env.josm_prerelease }}
+          ./native/macosx/macos-jpackage.sh ${{ needs.createrelease.outputs.josm_revision }}
       - name: Upload app
         if: ${{ runner.os == 'macos' && always() }}
@@ -126,17 +173,6 @@
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing its ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps 
+          upload_url: ${{ needs.createrelease.outputs.upload_url }} # This pulls from the CREATE RELEASE job above, referencing its ID to get its outputs object, which include a `upload_url`.
           asset_path: app/JOSM.zip
           asset_name: JOSM-${{ runner.os}}-java${{ matrix.java }}.zip
           asset_content_type: application/zip
-      - name: Upload jar
-        if: ${{ runner.os == 'macos' && always() }}
-        id: upload-jar
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing its ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps 
-          asset_path: dist/josm-custom.jar
-          asset_name: josm-latest.jar
-          asset_content_type: application/java-archive
Index: /trunk/native/macosx/macos-jpackage.sh
===================================================================
--- /trunk/native/macosx/macos-jpackage.sh	(revision 17372)
+++ /trunk/native/macosx/macos-jpackage.sh	(revision 17373)
@@ -18,21 +18,4 @@
 
 mkdir app
-jpackage -n "JOSM" --input dist --main-jar josm-custom.jar \
-    --main-class org.openstreetmap.josm.gui.MainApplication \
-    --icon ./native/macosx/JOSM.icns --type app-image --dest app \
-    --java-options "-Xmx8192m" --app-version $1 \
-    --copyright "JOSM, and all its integral parts, are released under the GNU General Public License v2 or later" \
-    --vendor "https://josm.openstreetmap.de" \
-    --file-associations native/macosx/bz2.properties \
-    --file-associations native/macosx/geojson.properties \
-    --file-associations native/macosx/gpx.properties \
-    --file-associations native/macosx/gz.properties \
-    --file-associations native/macosx/jos.properties \
-    --file-associations native/macosx/joz.properties \
-    --file-associations native/macosx/osm.properties \
-    --file-associations native/macosx/zip.properties \
-    --add-modules java.base,java.datatransfer,java.desktop,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.sql,java.transaction.xa,java.xml,jdk.crypto.ec,jdk.jfr,jdk.jsobject,jdk.unsupported,jdk.unsupported.desktop,jdk.xml.dom
-
-echo "Building done."
 
 if [[ $IMPORT_AND_UNLOCK_KEYCHAIN == 1 ]]; then
@@ -53,4 +36,5 @@
 
     KEYCHAIN=build.keychain
+    KEYCHAINPATH=~/Library/Keychains/$KEYCHAIN-db
     KEYCHAIN_PW=`head /dev/urandom | base64 | head -c 20`
     CERTIFICATE_P12=certificate.p12
@@ -67,15 +51,28 @@
 fi
 
-echo "Signing App Bundle…"
+echo "Building and signin app"
+    jpackage -n "JOSM" --input dist --main-jar josm-custom.jar \
+    --main-class org.openstreetmap.josm.gui.MainApplication \
+    --icon ./native/macosx/JOSM.icns --type app-image --dest app \
+    --java-options "-Xmx8192m" \
+     --java-options "-Dapple.awt.application.appearance=system" \
+    --app-version $1 \
+    --copyright "JOSM, and all its integral parts, are released under the GNU General Public License v2 or later" \
+    --vendor "https://josm.openstreetmap.de" \
+    --mac-sign \
+    --mac-package-identifier de.openstreetmap.josm \
+    --mac-package-signing-prefix de.openstreetmap.josm \
+    --mac-signing-keychain $KEYCHAINPATH \
+    --file-associations native/macosx/bz2.properties \
+    --file-associations native/macosx/geojson.properties \
+    --file-associations native/macosx/gpx.properties \
+    --file-associations native/macosx/gz.properties \
+    --file-associations native/macosx/jos.properties \
+    --file-associations native/macosx/joz.properties \
+    --file-associations native/macosx/osm.properties \
+    --file-associations native/macosx/zip.properties \
+    --add-modules java.base,java.datatransfer,java.desktop,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.sql,java.transaction.xa,java.xml,jdk.crypto.ec,jdk.jfr,jdk.jsobject,jdk.unsupported,jdk.unsupported.desktop,jdk.xml.dom
 
-codesign -vvv --timestamp --options runtime --deep --force --sign "$SIGNING_KEY_NAME" \
-    app/JOSM.app/Contents/MacOS/JOSM \
-    app/JOSM.app/Contents/runtime/Contents/Home/lib/*.jar \
-    app/JOSM.app/Contents/runtime/Contents/Home/lib/*.dylib \
-    app/JOSM.app/Contents/runtime/Contents/MacOS/libjli.dylib
-
-codesign -vvv --timestamp --entitlements native/macosx/josm.entitlements --options runtime --force --sign "$SIGNING_KEY_NAME" app/JOSM.app
-
-codesign -vvv app/JOSM.app
+echo "Building done."
 
 echo "Preparing for notarization"