nexus-staging hijacks the deploy phase, so a non-SNAPSHOT release cannot publish

[ghedwards]

This repository cannot publish a release version. Every attempt fails before any artifact is uploaded.

Reproduction

Set the version to anything without -SNAPSHOT and run the publish workflow. Observed on 2.16.0 at 590b115 (run 31670242695):

[INFO] Reactor Summary for coldfusion-parser 2.16.0:
[INFO] coldfusion-parser .................................. FAILURE [ 11.718 s]
[INFO] cfml.dictionary .................................... SKIPPED
[INFO] cfml.parsing ....................................... SKIPPED
[ERROR] Failed to execute goal org.sonatype.plugins:nexus-staging-maven-plugin:1.7.0:deploy
        (injected-nexus-deploy) on project cfparser:
        Server credentials with ID "ossrh" not found!

Nothing is published — the parent pom fails first and both library modules are skipped.

Cause

pom.xml declares:

<plugin>
  <groupId>org.sonatype.plugins</groupId>
  <artifactId>nexus-staging-maven-plugin</artifactId>
  <version>1.7.0</version>
  <extensions>true</extensions>
  <configuration>
    <serverId>ossrh</serverId>
    <nexusUrl>https://oss.sonatype.org/</nexusUrl>
    <autoReleaseAfterClose>false</autoReleaseAfterClose>
  </configuration>
</plugin>

<extensions>true</extensions> makes the plugin replace the deploy lifecycle — the goal that runs is injected-nexus-deploy, not maven-deploy-plugin. For a release version it performs the OSSRH staging workflow and requires a server credential with ID ossrh.

No such credential exists. The publish workflow's settings.xml defines only github, and distributionManagement points both <repository> and <snapshotRepository> at GitHub Packages. Publishing to Sonatype is not what this project does, so the plugin is vestigial — it dates back to 2.5.4-snapshot.

Why it has never been noticed

A -SNAPSHOT version does not take the staging path, so the plugin stays out of the way. Every successful publish in this repository's history has been a SNAPSHOT, including 2.15.2-SNAPSHOT on 10 August with this same plugin already in the pom. The bug is only reachable via the exact thing the workflow's tag trigger is designed for.

Fix

Remove the plugin. Verified locally that deploy then routes through maven-deploy-plugin and produces all three artifacts consumers need:

[INFO] --- deploy:3.1.2:deploy (default-deploy) @ cfparser ---
[INFO] --- deploy:3.1.2:deploy (default-deploy) @ cfml.dictionary ---
[INFO] --- deploy:3.1.2:deploy (default-deploy) @ cfml.parsing ---

com/github/cfmleditor/cfparser/2.16.0/cfparser-2.16.0.pom
com/github/cfmleditor/cfml.dictionary/2.16.0/cfml.dictionary-2.16.0.jar
com/github/cfmleditor/cfml.dictionary/2.16.0/cfml.dictionary-2.16.0.pom
com/github/cfmleditor/cfml.parsing/2.16.0/cfml.parsing-2.16.0.jar
com/github/cfmleditor/cfml.parsing/2.16.0/cfml.parsing-2.16.0.pom

The parent pom matters: consumers resolving cfml.parsing cannot do so without it.

There is also a stale comment at pom.xml:248 referencing mvn nexus-staging:release -P deploy, which should go at the same time.

Deferred deliberately — #57 releases as 2.16.0-SNAPSHOT on the known-working path rather than blocking on this.