chore(publish): restore Maven Central publishing in GitLab CI

The publish_maven_central job passed no credentials, so it could only
ever have produced unsigned artifacts and a 401 at upload; being manual
and allow_failure, it had never run. Map the project's SONATYPE_*
variables onto the ORG_GRADLE_PROJECT_* names Gradle reads, decoding the
base64 file variable SONATYPE_GPG_KEY_BASE64 into signingInMemoryKey,
and guard the decode so a malformed key fails with a clear message. Run
the job automatically on tags, as the GitHub Actions pipeline did before
the migration; a clean X.Y.Z tag still only stages a deployment in the
Central Portal for release by hand.

Restore the pre-release-to-SNAPSHOT mapping the migration dropped, which
keeps X.Y.Z-rcN tags out of Maven Central's monthly release quota. It is
now gated behind -PpreReleasesAsSnapshot=true, passed only by the Central
job, because Artifactory routes rc tags to caplin-rc off the literal tag
version.

Author: rossdanderson

.gitlab-ci.yml

@@ -78,20 +78,30 @@ publish_libraries:
     - job: "test_libraries"
       artifacts: false
 
-# Maven Central publishing, kept but not wired up: no signing/Sonatype credentials are configured
-# in this project yet, so this only runs when triggered manually.
+# Maven Central publishing. A clean X.Y.Z tag uploads a deployment that stays staged in the Central
+# Portal until released there by hand; an X.Y.Z-rcN tag uploads an overwriting X.Y.Z-SNAPSHOT.
+# SONATYPE_GPG_KEY_BASE64 is a file variable holding the base64-encoded armoured private key.
 publish_maven_central:
   stage: publish
   image: registry.access.redhat.com/ubi9/openjdk-17
+  variables:
+    ORG_GRADLE_PROJECT_signingInMemoryKeyId: "BD2A1230"
+    ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: "$SONATYPE_GPG_PASSWORD"
+    ORG_GRADLE_PROJECT_mavenCentralUsername: "$SONATYPE_USERNAME"
+    ORG_GRADLE_PROJECT_mavenCentralPassword: "$SONATYPE_PASSWORD"
   script:
-    - ./gradlew --console=colored --no-configuration-cache publishToMavenCentral
+    - export ORG_GRADLE_PROJECT_signingInMemoryKey="$(base64 --decode "$SONATYPE_GPG_KEY_BASE64")"
+    - |
+      case "$ORG_GRADLE_PROJECT_signingInMemoryKey" in
+        "-----BEGIN PGP PRIVATE KEY BLOCK-----"*) ;;
+        *) echo "SONATYPE_GPG_KEY_BASE64 did not decode to an armoured PGP private key"; exit 1 ;;
+      esac
+    - ./gradlew --console=colored --no-configuration-cache -PpreReleasesAsSnapshot=true publishToMavenCentral
   cache:
     <<: *gradle_cache
     policy: pull
   rules:
     - if: $CI_COMMIT_TAG
-      when: manual
-  allow_failure: true
   needs:
     - job: "build_libraries"
     - job: "test_libraries"

buildSrc/src/main/kotlin/common-maven.gradle.kts

@@ -5,11 +5,22 @@ group = "com.caplin.integration.datasourcex"
 val configuredVersion =
     System.getenv("CI_COMMIT_TAG") ?: System.getenv("CI_COMMIT_REF_SLUG") ?: "dev"
 
-version = configuredVersion
+// Maven Central counts releases and files against a monthly quota, so pre-release tags (X.Y.Z-rcN)
+// publish there as an overwriting X.Y.Z-SNAPSHOT to the quota-exempt snapshot repository. Artifactory
+// takes the literal tag version, which is what routes an rc tag to caplin-rc; only the
+// publish_maven_central job passes -PpreReleasesAsSnapshot=true.
+val preReleasesAsSnapshot = providers.gradleProperty("preReleasesAsSnapshot").orNull.toBoolean()
+
+version =
+    if (preReleasesAsSnapshot && configuredVersion.contains('-')) {
+      "${configuredVersion.substringBefore('-')}-SNAPSHOT"
+    } else {
+      configuredVersion
+    }
 
 mavenPublishing {
-  // Kept registered but not run by default CI — Artifactory is the active publish target.
-  // See the manual, tag-gated publish_maven_central job in .gitlab-ci.yml.
+  // Release deployments land staged in the Central Portal and need releasing there by hand;
+  // snapshots upload straight to the snapshot repository. See the publish_maven_central job.
   publishToMavenCentral()
 
   // Only sign when a signing key is configured (as CI does via ORG_GRADLE_PROJECT_signingInMemoryKey).