Publish solely to the Code Genome Project

[timtebeek]

• Follow-up to Allow resolving dependencies from the Code Genome Project #1183, which added the Code Genome Project (CGP) as a source for dependencies. This switches the destination: snapshots and releases are deployed only to CGP, and Sonatype/OSSRH is dropped entirely.

Draft, because it retires the Maven Central publication path and cannot be verified without a real publish — the questions below want an answer before this merges.

What changed

• pom.xml
  • distributionManagement (both repository and snapshotRepository) points at s3://codegenome-artifacts/maven. CGP serves releases and snapshots from one flat repository, so both entries are the same URL; the id codegenome-s3 is deliberately distinct from the codegenome read repository added in Allow resolving dependencies from the Code Genome Project #1183, since the two authenticate differently (settings.xml server vs. the AWS environment).
  • Adds the net.pennix:maven-wagon-s3v2 build extension. The HTTP service is read-only, so deploys go to the bucket directly, and Maven has no built-in s3:// transport. Credentials and region come from the standard AWS SDK v2 provider chain — the wagon does not read Maven <server> credentials.
  • Removes nexus-staging-maven-plugin from the release profile; with <extensions>true</extensions> it hijacked deploy to stage into Nexus. The stock maven-deploy-plugin now runs, which merges remote maven-metadata.xml the way CGP's ADR 13 expects of a publisher.
• ci.yml / publish.yml — one setup-java call instead of two: it writes the codegenome server plus the GPG key into the default ~/.m2/settings.xml, so the --settings flags are gone and release:perform's forked Maven picks the credentials up without extra plumbing. Publish steps get CGP_AWS_ACCESS_KEY_ID/CGP_AWS_SECRET_ACCESS_KEY and AWS_REGION: us-west-2 (the wagon defaults to us-east-1 otherwise). GPG signing is kept; the passphrase moves to the conventional MAVEN_GPG_PASSPHRASE name, still fed from OSSRH_SIGNING_PASSWORD.
• README.md — the snapshot instructions pointed at Sonatype snapshots, which will no longer receive anything.

Verified locally

./mvnw validate resolves the extension, and a deploy-file against a bogus bucket reaches S3 and fails with a 403 on the fake key rather than "no transporter for s3://", so the wagon is wired through distributionManagement correctly. The actual upload can only be exercised with real credentials.

Worth a decision before merge

1. Sole vs. dual publish. The Gradle convention plugin (RewriteCgpPublishPlugin) publishes to CGP in addition to Sonatype. This does what the title says and drops Sonatype — deliberate, but it diverges from the Gradle repos, and it means the plugin stops appearing on Maven Central.
2. Snapshot consumers lose anonymous access. CGP rejects anonymous requests, so the README's snapshot instructions now require credentials that public contributors do not have.
3. Third-party wagon. net.pennix:maven-wagon-s3v2 is a single-maintainer artifact, last released 2023, pulling AWS SDK 2.17.212. It is the only maintained SDK-v2 S3 wagon I found. The alternative is mvn deploy to a staging directory plus aws s3 sync, but that would make us responsible for merging artifact-level maven-metadata.xml ourselves.
4. Out of scope, but adjacent: bump-snapshots.yml and the two versions:update-properties steps in publish.yml do not set CODEGENOME_USERNAME, so the codegenome profile stays inactive there and they will stop seeing new org.openrewrite versions once Central is retired. Happy to fix here or in a separate PR.