Stop nexus-staging hijacking the deploy phase

[ghedwards]

Closes #58.

nexus-staging-maven-plugin declared <extensions>true</extensions>, which replaces the deploy lifecycle — the goal that ran was injected-nexus-deploy, never maven-deploy-plugin. For a release version it performed the OSSRH staging workflow and required a server credential with ID ossrh. Nothing defines one, and nothing should: distributionManagement points both repositories at GitHub Packages.

The result was that no non-SNAPSHOT version could publish. Run 31670242695 on 2.16.0:

[INFO] coldfusion-parser .................................. FAILURE [ 11.718 s]
[INFO] cfml.dictionary .................................... SKIPPED
[INFO] cfml.parsing ....................................... SKIPPED
[ERROR] ... Server credentials with ID "ossrh" not found!

Nothing was uploaded — the parent pom failed first and took the modules with it.

Why it survived since 2.5.4-snapshot

A SNAPSHOT version doesn't take the staging path. The same plugin, in the same pom, on the successful 2.16.0-SNAPSHOT publish an hour later:

--- nexus-staging:1.7.0:deploy (injected-nexus-deploy) @ cfml.parsing ---
[INFO]  * Bulk deploying locally gathered snapshot artifacts
[INFO] Remote deploy finished with success.

Every successful publish in this repository's history has been a SNAPSHOT, so the failure mode was only reachable by the one thing the workflow's tag trigger exists to do.

Verification

Deploy routing, against a local file repository so nothing touches the network. Both version shapes, because the SNAPSHOT path is the one that currently works and must not regress:

Version under test	Result
2.16.0-SNAPSHOT	deploy:3.1.2:deploy (default-deploy) × 3, timestamped artifacts
2.16.0-RELEASETEST	deploy:3.1.2:deploy (default-deploy) × 3 — previously failed here

The release run produced what the failing run never reached:

com/github/cfmleditor/cfparser/2.16.0-RELEASETEST/cfparser-2.16.0-RELEASETEST.pom
com/github/cfmleditor/cfml.dictionary/2.16.0-RELEASETEST/cfml.dictionary-2.16.0-RELEASETEST.jar
com/github/cfmleditor/cfml.dictionary/2.16.0-RELEASETEST/cfml.dictionary-2.16.0-RELEASETEST.pom
com/github/cfmleditor/cfml.parsing/2.16.0-RELEASETEST/cfml.parsing-2.16.0-RELEASETEST.jar
com/github/cfmleditor/cfml.parsing/2.16.0-RELEASETEST/cfml.parsing-2.16.0-RELEASETEST.pom

The parent pom is there, which CLAUDE.md flags as the artifact consumers resolving cfml.parsing cannot do without.

The temporary version was reverted and mvn package re-run, so the twelve version locations all read 2.16.0-SNAPSHOT and the diff is pom.xml alone.

• 318 tests, ./gradlew build
• Diff is 15 deletions in one file

Also removed

Four trailing comments documenting a Sonatype publishing route this project does not use:

<!-- Sonatype: mvn clean package -P deploy -pl "!cfml.dictionary"-->
<!-- Sonatype: mvn verify gpg:sign -DskipTests -P deploy -pl "!cfml.dictionary"-->
<!-- Sonatype: mvn deploy -DskipTests -P deploy -pl "!cfml.dictionary" -->
<!-- Sonatype: mvn nexus-staging:release -P deploy -DskipTests -->

The deploy profile itself stays — it carries the source, javadoc and GPG plugins and is independent of where artifacts go.

Not fixed here

Noticed while tracing this, out of scope, no issue filed yet: the publish workflow runs plain mvn deploy without -P deploy, so the maven-source-plugin and maven-javadoc-plugin executions never fire. Published artifacts carry no sources or javadoc jars. Worth a look separately — say the word and I'll file it.

---

Generated by Claude Code