Improve Maven Central publishing resilience and debugging

.github/workflows/publish.yml

@@ -215,26 +215,40 @@ jobs:
             *-SNAPSHOT) echo "OK: -SNAPSHOT version, continuing snapshot deploy." ;;
             *) echo "::error::Refusing to publish non-SNAPSHOT version '$VERSION' from the snapshot job. Snapshot publishing requires a -SNAPSHOT version; releases go through the v* tag path."; exit 1 ;;
           esac
+      # Informational only (nothing depends on it): logs the effective POM with the same
+      # profile as the deploy below, so the resolved central-publishing configuration
+      # (waitUntil/waitMaxTime etc.) is visible for debugging.
+      - name: Show effective POM (debug)
+        run: mvn --batch-mode --no-transfer-progress -P release help:effective-pom
       - name: Deploy snapshot
         run: mvn --batch-mode --no-transfer-progress -P release deploy -DskipTests
         env:
           MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      # Runs even when the deploy step failed: a Central publish-poll timeout reds the
+      # job *after* the bundle was uploaded (and typically published server-side), while
+      # the signed jars + .asc files already exist in target/ (signing happens at
+      # verify). Collecting on failure lets the github-snapshot job still attach them.
       - name: Collect signed artifacts
+        if: ${{ !cancelled() }}
         run: |
           mkdir -p signed-snapshot-assets
           cp target/*.jar signed-snapshot-assets/ 2>/dev/null || true
           cp target/*.jar.asc signed-snapshot-assets/ 2>/dev/null || true
       - uses: actions/upload-artifact@v7
+        if: ${{ !cancelled() }}
         with:
           name: signed-snapshot-assets
           path: signed-snapshot-assets/
 
   github-snapshot:
     name: Update Snapshot Pre-release on GitHub
     needs: [publish-snapshot]
-    if: needs.publish-snapshot.result == 'success'
+    # Also runs when publish-snapshot FAILED (not when skipped/cancelled): a Central
+    # publish-poll timeout reds that job after the artifacts were already uploaded —
+    # the GitHub pre-release assets must not be lost in that case.
+    if: ${{ !cancelled() && (needs.publish-snapshot.result == 'success' || needs.publish-snapshot.result == 'failure') }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -277,26 +291,40 @@ jobs:
           server-password: MAVEN_PASSWORD
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
+      # Informational only (nothing depends on it): logs the effective POM with the same
+      # profile as the deploy below, so the resolved central-publishing configuration
+      # (waitUntil/waitMaxTime etc.) is visible for debugging.
+      - name: Show effective POM (debug)
+        run: mvn --batch-mode --no-transfer-progress -P release help:effective-pom
       - name: Deploy release
         run: mvn --batch-mode --no-transfer-progress -P release deploy -DskipTests
         env:
           MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+      # Runs even when the deploy step failed: a Central publish-poll timeout reds the
+      # job *after* the bundle was uploaded (and typically published server-side), while
+      # the signed jars + .asc files already exist in target/ (signing happens at
+      # verify). Collecting on failure lets the github-release job still attach them.
       - name: Collect signed artifacts
+        if: ${{ !cancelled() }}
         run: |
           mkdir -p signed-release-assets
           cp target/*.jar signed-release-assets/ 2>/dev/null || true
           cp target/*.jar.asc signed-release-assets/ 2>/dev/null || true
       - uses: actions/upload-artifact@v7
+        if: ${{ !cancelled() }}
         with:
           name: signed-release-assets
           path: signed-release-assets/
 
   github-release:
     name: Attach Binaries to GitHub Release
     needs: [publish-release]
-    if: needs.publish-release.result == 'success'
+    # Also runs when publish-release FAILED (not when skipped/cancelled): a Central
+    # publish-poll timeout reds that job after the artifacts were already uploaded —
+    # the GitHub release assets must not be lost in that case.
+    if: ${{ !cancelled() && (needs.publish-release.result == 'success' || needs.publish-release.result == 'failure') }}
     runs-on: ubuntu-latest
     permissions:
       contents: write

pom.xml

@@ -350,7 +350,7 @@ SPDX-License-Identifier: Apache-2.0
                 <plugin>
                     <groupId>org.pitest</groupId>
                     <artifactId>pitest-maven</artifactId>
-                    <version>1.25.5</version>
+                    <version>1.25.6</version>
                 </plugin>
                 <plugin>
                     <groupId>org.sonatype.central</groupId>
@@ -819,7 +819,10 @@ SPDX-License-Identifier: Apache-2.0
                         <configuration>
                             <publishingServerId>central</publishingServerId>
                             <autoPublish>true</autoPublish>
-                            <waitUntil>published</waitUntil>
+                            <!-- validated: wait only for portal validation (where real errors surface), not the slow server-side publish; autoPublish completes it -->
+                            <waitUntil>validated</waitUntil>
+                            <!-- seconds; generous headroom for the validation poll (default 1800) -->
+                            <waitMaxTime>21600</waitMaxTime>
                         </configuration>
                     </plugin>
                 </plugins>