Fix Maven Central publish: migrate to Sonatype Central Portal

[Narayana Shanbhog Plivo (narayana-plivo)]

Summary

Root cause of 15 missing releases. Every plivo-java tag after v5.46.0 (2025-04-30) — v5.46.1 through v5.50.0 — is in git but not on Maven Central. Sonatype retired the legacy OSSRH staging API mid-2025 (see Central Portal migration); our io.codearte.nexus-staging plugin v0.30.0 only spoke that API, so ./gradlew publish uploaded to nothing.

Customer impact: at least one customer is blocked on v5.48.0 which contains the PropertyNamingStrategy.SNAKE_CASE → PropertyNamingStrategies.SNAKE_CASE change needed for Jackson 2.20+ (Spring Boot 3.5.16 fails at startup with NoSuchFieldError on the old constant). Their workaround pins Jackson to 2.19.4, blocking security patches.

What this changes:

• Swap io.codearte.nexus-staging 0.30.0 → io.github.gradle-nexus.publish-plugin 2.0.0 (Central Portal–compatible via the OSSRH Staging API bridge).
• Point at ossrh-staging-api.central.sonatype.com/service/local/; snapshots at central.sonatype.com/repository/maven-snapshots/.
• Drop the manual publishing.repositories.maven { url ... } block. nexus-publish adds a staged sonatype repository automatically; the manual one produced a second, non-staged target that skipped close-and-release.
• Rewire the upload task to publishToSonatype + closeAndReleaseSonatypeStagingRepository so plivo_standard_libs@sdks Jenkins pipeline invocations keep working (see caveat below).
• Update publish.sh accordingly.

⚠️ Critical constraint — publish + close + release MUST run in one Gradle invocation

The OSSRH Staging API bridge does not support looking up an existing staging repository (returns HTTP 400: "Endpoint /service/local/staging/profile_repositories/ not supported" — see upstream gradle-nexus/publish-plugin#379). This means:

• ✅ ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository (one invocation) — works.
• ✅ ./gradlew upload (this PR's task, depends on both) — works.
• ✅ ./publish.sh (this PR's rewrite) — works.
• ❌ ./gradlew publishToSonatype in one step, then ./gradlew closeAndReleaseSonatypeStagingRepository in a separate step — fails at find-repo lookup.
• ❌ ./gradlew publish alone — uploads to staging but does not close/release; artifact sits OPEN in the Portal and never reaches Maven Central.

Action required: confirm the sdksPipeline step in plivo_standard_libs@sdks invokes ./gradlew upload or ./publish.sh or the full publishToSonatype closeAndReleaseSonatypeStagingRepository chain — not a bare ./gradlew publish.

Ops prerequisites before merging

• Central Portal user-token issued at central.sonatype.com/account → exported as MAVEN_USERNAME / MAVEN_PASSWORD in the Jenkins credential store. Old OSSRH tokens do not work (upstream #384).
• Confirm com.plivo namespace is visible under Namespaces on the Central Portal (auto-migrated by Sonatype mid-2025; usually fine but confirm).
• GPG signing key already present in Jenkins as SONATYPE_SECRET_RING_FILE (unchanged — the signing { } block is unchanged).
• Jenkins shared-lib invocation confirmed (see "Critical constraint" above).

Known upstream flakiness (documented, not blocking merge)

The bridge API itself has documented reliability issues that no plugin config can fully mitigate: socket timeouts on close, occasional "No objects found in the repository" 400s (upstream #398, openremote#2523). This PR increases clientTimeout/connectTimeout to 5 min and retries to 180 to widen the window. If the first publish attempt times out mid-close, the release may still succeed server-side — check the Portal UI before retrying.

PR Template

Type of Change: bug fix (publish pipeline; no runtime code change).

Impact on Prepaid Customers: none — build/CI-only change.
Impact on Postpaid Customers: none — build/CI-only change.
Impact on downstream services: unblocks Maven Central publishes; downstream customers on Jackson ≥ 2.20 get an upgrade path.
Impact on upstream services: none.
Rollback Plan: revert this commit. Rollback is safe — the old plugin was already producing no artifacts.
Unit tests: N/A — no runtime code change.
Tested locally / staging: ⚠️ Static verification only. Plugin coordinates + version resolve on Gradle Plugin Portal; DSL properties (nexusUrl, snapshotRepositoryUrl, username, password, connectTimeout, clientTimeout, transitionCheckOptions{maxRetries, delayBetween}) and task classes (InitializeNexusStagingRepository, CloseNexusStagingRepository, ReleaseNexusStagingRepository) confirmed against the actual plugin class files. Config shape matches TWiStErRob/net.twisterrob.gradle#951 which publishes successfully to Central. Requires a real smoke publish before merging.
Opsgenie alerts: N/A.
Sensitive data: none in this diff; credentials sourced from env / Jenkins.
Related: Customer ticket from Karthik G. — "Plivo SDK Jackson Compatibility Issue" (Jackson 2.20 / NoSuchFieldError on PropertyNamingStrategy.SNAKE_CASE).

Test plan

• ./gradlew tasks --group=publishing lists publishToSonatype, closeSonatypeStagingRepository, releaseSonatypeStagingRepository, closeAndReleaseSonatypeStagingRepository.
• ./gradlew publishToMavenLocal succeeds (validates POM, signing, artifacts) without needing Sonatype creds.
• Cut a throwaway 5.50.1-SNAPSHOT and run ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository in a single invocation — artifact appears in the Portal's Deployments view, transitions VALIDATED → PUBLISHED, and is resolvable at https://repo1.maven.org/maven2/com/plivo/plivo-java/<version>/ within ~30 min.
• Cut v5.50.1 (or bump to v5.51.0) so the customer can pull the Jackson fix.

Notes for reviewer(s) / QA

• 15 tags need catch-up releases. Suggest publishing v5.50.0 (or a fresh v5.51.0) first to unblock the customer, then decide whether older intermediate tags need re-cutting.

🤖 Generated with Claude Code