Keep runtime deps in published POM; auto-publish to Maven Central

[jochen-testingbot]

Follow-up to #27. Two fixes to how the Maven artifact is published — both needed before 4.x can be consumed from Maven Central (and the reason 4.8 built green but never appeared there).

1. Keep runtime dependencies in the published POM (critical)

#27 attaches the uber jar under the shaded classifier and publishes a thin main jar. But maven-shade-plugin defaults to createDependencyReducedPom=true, which removes from the published POM every dependency that was shaded into the uber jar — i.e. Jetty, Apache HTTP, commons-cli, Jackson, logback, jsch, prometheus.

Result: the thin TestingBotTunnel.jar published to Central declared only test-scoped dependencies, so any consumer got a jar whose runtime classes were unresolvable (NoClassDefFoundError: org/apache/commons/cli/..., missing Jetty, etc.).

Fix: createDependencyReducedPom=false. Verified locally — the installed POM now declares all runtime deps (jetty-server, jetty-proxy, jetty-servlet, jetty-servlets, httpclient5, commons-cli, jackson-databind, slf4j, logback, jsch, prometheus) while the main jar stays thin (0 bundled Jetty classes).

2. Auto-publish to Maven Central

The central-publishing-maven-plugin had no autoPublish, so it defaults to a manual release: mvn deploy only uploads a pending/validated deployment that then needs a "Publish" click in the Central Portal. That's why the 4.8 publish workflow ran green but 4.8 never showed up on Central.

Fix: autoPublish=true + waitUntil=published, so a deploy from either the tag-triggered release.yml or the manual Publish to Maven Central workflow actually releases to Central.

⚠️ Note on the pending 4.8 deployment

The 4.8 already uploaded to the Central Portal was built before fix #1, so it has the broken dependency-reduced POM. Since Central versions are immutable, please drop that pending 4.8 deployment in the portal before publishing. After merging this PR, publish a corrected build (re-run the publish for 4.8 if the pending one is dropped, or tag 4.9) — it will now be both thin and have a complete POM, and will publish automatically.

Summary by CodeRabbit

• Chores
  • Improved release publishing automation so artifacts are published and verified more reliably.
  • Updated package metadata to accurately reflect dependencies for both standard and runnable distributions.
  • Ensured published artifacts remain compatible with expected dependency resolution.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fa8b7efc-ed7b-432a-a6c0-5bc267259570

📥 Commits

Reviewing files that changed from the base of the PR and between 62d4778 and 58eb425.

📒 Files selected for processing (1)

• pom.xml

---

📝 Walkthrough

Walkthrough

The Maven build now automatically publishes Central releases, waits for the published state, and retains the original dependency POM when creating the shaded artifact.

Changes

Maven release configuration

Layer / File(s)	Summary
Publishing and shaded artifact configuration pom.xml	Central publishing enables automatic publication and waits for published; the Shade Plugin disables dependency-reduced POM creation.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• testingbot/Testingbot-Tunnel#27: Updates related Maven Shade Plugin packaging and published POM configuration.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	Issue #1 asks for a Maven plugin that runs in pre/post-integration-test, but this PR only changes publishing and shade POM settings.	Implement the Maven plugin lifecycle integration and tunnel startup/shutdown behavior requested in issue #1.
Out of Scope Changes check	⚠️ Warning	The publishing and shade POM changes are unrelated to the linked plugin lifecycle request in issue #1.	Remove unrelated publishing changes or add the requested Maven plugin implementation in scope with issue #1.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the two main changes: preserving runtime deps in the published POM and enabling automatic Maven Central publishing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands.}