ci: publish to maven central without the portal click

.github/workflows/android.yml

@@ -243,26 +243,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # Uploads a deployment to the portal and leaves it there. Releasing it to
-      # Maven Central is a click in the portal UI, deliberately: Central never
-      # forgets a version, so this is the last point at which a bad artifact can
-      # still be dropped instead of lived with.
       - name: publish to maven central
         working-directory: android
-        # `shell: bash` for the pipefail it sets - the default `bash -e` would
-        # let tee's exit code hide a failing gradle
-        shell: bash
-        run: ./gradlew publishToMavenCentral -Podr.abis= | tee "${RUNNER_TEMP}/publish.log"
+        run: ./gradlew publishToMavenCentral -Podr.abis=
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
           ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
           ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
           ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASS }}
-
-      # The step above exits 0 however the portal judges the bundle, so without
-      # this a release central rejected looks like one that worked.
-      - name: await central validation
-        env:
-          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
-        run: .github/scripts/await-central-validation.sh "${RUNNER_TEMP}/publish.log"

.github/workflows/maven.yml

@@ -86,8 +86,6 @@ jobs:
           gpg-private-key: ${{ secrets.SIGNING_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
-      # Uploads and stops, the way the AAR does — released by hand from the
-      # portal, because Central never forgets a version.
       - name: publish to maven central
         run: mvn --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Pcentral -Drevision="${REVISION}"
         env:

android/README.md

@@ -124,10 +124,9 @@ key being configured, so `publishToMavenLocal` and the GitHub Packages publish
 still work without one; an unsigned upload is rejected by the portal, so the
 release path stays guarded either way.
 
-Publishing **uploads a deployment to the portal and stops**. Releasing it is a
-deliberate click in the portal UI, because Central never forgets a version —
-that click is the last point at which a bad artifact can be dropped rather than
-lived with.
+Publishing **releases the deployment**, no click in the portal. The build waits
+until it is published, so a green publish job means the version is on Central
+and a bundle the portal rejects fails the release.
 
 For now OpenDocument.droid keeps building odrcore from the conan package
 (`with_jni=True`), deploying `libodr_jni.so` and `odr-core-java.jar` out of it. That path is unaffected by anything here, and it is the reason the

android/build.gradle.kts

@@ -175,13 +175,11 @@ dependencies {
 mavenPublishing {
     configure(AndroidSingleVariantLibrary(variant = "release"))
 
-    // Uploads to the portal and stops. A human releases it from there, so a bad
-    // artifact is still recallable — Central is immutable once released.
-    //
-    // Waiting for VALIDATED is what makes a failed deployment fail the release:
-    // the default uploads, prints "Skipping deployment validation!" and exits 0
-    // whatever the portal then makes of the bundle.
-    publishToMavenCentral(false, DeploymentValidation.VALIDATED)
+    // Releases the deployment rather than parking it in the portal, and waits
+    // for it to land: a release is reported as published on the strength of
+    // this task's exit code, and the default prints "Skipping deployment
+    // validation!" and exits 0 whatever the portal makes of the bundle.
+    publishToMavenCentral(true, DeploymentValidation.PUBLISHED)
 
     // Only Central demands a signature. Making it unconditional would mean no
     // `publishToMavenLocal` and no GitHub Packages publish without a private

jni/README.md

@@ -27,7 +27,8 @@ The native library is loaded from `java.library.path` as `odr_jni`
 The Java classes are published as `app.opendocument:odr-core-java` to Maven
 Central and to
 [GitHub Packages](https://github.com/orgs/opendocument-app/packages?repo_name=OpenDocument.core)
-on release (`.github/workflows/maven.yml`, built from `pom.xml`). The artifact
+on release (`.github/workflows/maven.yml`, built from `pom.xml`); the Central
+deployment publishes itself, no click in the portal. The artifact
 contains **only the Java API** — consumers build the native `odr_jni` library
 themselves for their target platform (see below) and provide it at runtime.
 

jni/pom.xml

@@ -170,9 +170,11 @@
             <extensions>true</extensions>
             <configuration>
               <publishingServerId>central</publishingServerId>
-              <!-- Uploads and stops, the way the AAR does: a human releases it
-                   from the portal, and Central is immutable once released. -->
-              <autoPublish>false</autoPublish>
+              <autoPublish>true</autoPublish>
+              <!-- Not the `validated` default: a release is reported as
+                   published on the strength of this build's exit code, and
+                   validation passing is no promise that publishing did. -->
+              <waitUntil>published</waitUntil>
               <!-- The plugin's default is the literal "Deployment", which tells
                    nobody which of the two uploads they are looking at. Same
                    shape the AAR's plugin builds for itself. -->