From 65a4fc66970d87ed6b46392be9258f19ced4b084 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 15 Jul 2026 22:28:03 +0000
Subject: [PATCH] Fix attach-sources phase binding: gpg was signing before
 sources jar existed

All three real modules bound maven-source-plugin's attach-sources
execution to the verify phase instead of package. maven-gpg-plugin's
sign-artifacts execution (release profile) is also bound to verify, and
package always runs before verify - but within the SAME phase, execution
order follows declaration/inheritance order, and the parent-inherited
gpg execution ran before the child's own attach-sources. gpg therefore
signed only the main jar + javadoc jar + pom, silently omitting the
sources jar on every module.

This caused the first real v1.1.0 release attempt to fail Sonatype
Central's deployment validation ("Missing signature for file:
*-sources.jar" on all three real modules) - caught only on that real
attempt, since every prior local dry run used -Dgpg.skip=true, which
also skips the real execution-order interaction between these two
plugins.

Fix: bind attach-sources to package (its own goal default) in all three
modules. Verified with a real throwaway GPG key (not skip=true): gpg now
signs 4 files for srcmorph and srcmorph-maven-plugin (was 3), 5 for
srcmorph-cli (was 4, includes the fat jar), and every module's target/
now has a *-sources.jar.asc on disk. Full `mvn clean verify` still
passes.
---
 srcmorph-cli/pom.xml          | 15 ++++++++++++++-
 srcmorph-maven-plugin/pom.xml | 15 ++++++++++++++-
 srcmorph/pom.xml              | 15 ++++++++++++++-
 3 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml
index 26c98f6..0650d67 100644
--- a/srcmorph-cli/pom.xml
+++ b/srcmorph-cli/pom.xml
@@ -428,7 +428,20 @@ SPDX-License-Identifier: Apache-2.0
                 <executions>
                     <execution>
                         <id>attach-sources</id>
-                        <phase>verify</phase>
+                        <!--
+                            Must run at package (jar-no-fork's own default phase), NOT verify.
+                            maven-gpg-plugin's sign-artifacts execution (release profile) is bound
+                            to verify; package always runs before verify in the lifecycle, so the
+                            sources jar must be built and attached here to exist before signing
+                            runs. Binding this to verify put it in the SAME phase as gpg:sign,
+                            and — since the parent's inherited gpg execution ran first — gpg
+                            signed only the main jar + javadoc jar + pom, silently omitting the
+                            sources jar. Sonatype Central's deployment validation then rejected
+                            the whole bundle for a missing signature (caught on the first real
+                            release attempt; not visible in any dry run that passed -Dgpg.skip=true,
+                            which also skips the real execution-order interaction).
+                        -->
+                        <phase>package</phase>
                         <goals>
                             <goal>jar-no-fork</goal>
                         </goals>
diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml
index ab7eabc..49c9f81 100644
--- a/srcmorph-maven-plugin/pom.xml
+++ b/srcmorph-maven-plugin/pom.xml
@@ -531,7 +531,20 @@ SPDX-License-Identifier: Apache-2.0
                 <executions>
                     <execution>
                         <id>attach-sources</id>
-                        <phase>verify</phase>
+                        <!--
+                            Must run at package (jar-no-fork's own default phase), NOT verify.
+                            maven-gpg-plugin's sign-artifacts execution (release profile) is bound
+                            to verify; package always runs before verify in the lifecycle, so the
+                            sources jar must be built and attached here to exist before signing
+                            runs. Binding this to verify put it in the SAME phase as gpg:sign,
+                            and — since the parent's inherited gpg execution ran first — gpg
+                            signed only the main jar + javadoc jar + pom, silently omitting the
+                            sources jar. Sonatype Central's deployment validation then rejected
+                            the whole bundle for a missing signature (caught on the first real
+                            release attempt; not visible in any dry run that passed -Dgpg.skip=true,
+                            which also skips the real execution-order interaction).
+                        -->
+                        <phase>package</phase>
                         <goals>
                             <goal>jar-no-fork</goal>
                         </goals>
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index e84218c..1145e31 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -430,7 +430,20 @@ SPDX-License-Identifier: Apache-2.0
                 <executions>
                     <execution>
                         <id>attach-sources</id>
-                        <phase>verify</phase>
+                        <!--
+                            Must run at package (jar-no-fork's own default phase), NOT verify.
+                            maven-gpg-plugin's sign-artifacts execution (release profile) is bound
+                            to verify; package always runs before verify in the lifecycle, so the
+                            sources jar must be built and attached here to exist before signing
+                            runs. Binding this to verify put it in the SAME phase as gpg:sign,
+                            and — since the parent's inherited gpg execution ran first — gpg
+                            signed only the main jar + javadoc jar + pom, silently omitting the
+                            sources jar. Sonatype Central's deployment validation then rejected
+                            the whole bundle for a missing signature (caught on the first real
+                            release attempt; not visible in any dry run that passed -Dgpg.skip=true,
+                            which also skips the real execution-order interaction).
+                        -->
+                        <phase>package</phase>
                         <goals>
                             <goal>jar-no-fork</goal>
                         </goals>