build: automate the Gradle publishToMavenCentral task

Signed-off-by: Andreas Reichel <andreas@manticore-projects.com>

Author: manticore-projects

.github/workflows/ci.yml

@@ -39,8 +39,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-#       os: [ ubuntu-latest, windows-latest, macos-latest ]
-       os: [ ubuntu-latest, macos-latest ]
+        #       os: [ ubuntu-latest, windows-latest, macos-latest ]
+        os: [ ubuntu-latest, macos-latest ]
     steps:
       - uses: actions/checkout@main
         with:
@@ -75,10 +75,20 @@ jobs:
         uses: gradle/actions/setup-gradle@main
 
       - name: Publish with Gradle
-        run: ./gradlew publish
+        # Gradle only picks up a secret as a project property when it is exported with the
+        # ORG_GRADLE_PROJECT_ prefix. Plain `ossrhUsername: ...` was an ordinary environment
+        # variable that nothing ever read.
+        #
+        # No RELEASE variable here on purpose: getVersion() then produces a -SNAPSHOT version and
+        # the plugin routes it to the Central Portal snapshot repository. Set RELEASE=true only
+        # when you actually intend to cut a release.
+        run: ./gradlew publishToMavenCentral
         env:
-          ossrhUsername: ${{ secrets.OSSRHUSERNAME }}
-          ossrhPassword: ${{ secrets.OSSRHPASSWORD }}
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.mavenCentralUsername }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.mavenCentralPassword }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.signingInMemoryKey }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.signingInMemoryKeyId }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.signingInMemoryKeyPassword }}
 
       - uses: actions/setup-python@main
 
@@ -101,4 +111,4 @@ jobs:
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@main
+        uses: actions/deploy-pages@main

build.gradle

@@ -589,7 +589,9 @@ tasks.register('sphinx', Exec) {
     }
 }
 
-publish {
+// `publish` is Gradle's own task; the Central Portal upload runs under `publishToMavenCentral`.
+// Both need the same prerequisites, or a CI job invoking the latter silently skips check and docs.
+tasks.matching { it.name in ['publish', 'publishToMavenCentral'] }.configureEach {
     dependsOn(check, gitChangelogTask, renderRR, xslt, xmldoc)
 }
 
@@ -636,14 +638,9 @@ mavenPublishing {
     }
 }
 
-// Fix signing task dependencies
-tasks.withType(AbstractPublishToMaven).configureEach {
-    dependsOn(tasks.withType(Sign))
-}
-
-signing {
-    required { !version.endsWith("SNAPSHOT") && gradle.taskGraph.hasTask("publish") }
-}
+// Signing and its task wiring are handled by mavenPublishing.signAllPublications() above.
+// The manual `signing { required { ... hasTask("publish") } }` block that used to live here
+// never matched the `publishToMavenCentral` task, so the two disagreed about whether to sign.
 
 tasks.withType(JavaCompile).configureEach {
     options.encoding = 'UTF-8'