Migrate to new Maven Central Portal for publishing

Replace legacy OSSRH/Nexus publishing with the new Maven Central Portal:

- Replace `io.github.gradle-nexus.publish-plugin` with `tech.yanand.maven-central-publish`
- Remove old OSSRH repository configuration
- Add `mavenCentral` block for new Central Portal API
- Update publish workflow to use `publishToMavenCentralPortal` task
- Update GitHub Actions to v4 and add fetch-depth for git-version plugin
- Simplify workflow by separating GitHub Packages and Maven Central steps

The new publishing requires a `MAVEN_CENTRAL_TOKEN` secret generated from
https://central.sonatype.com/account (View Account -> Generate User Token)

Fixes PER-13671

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: zeevmoney

.github/workflows/publish.yaml

@@ -1,4 +1,4 @@
-name: Publish package to GitHub Packages
+name: Publish package to GitHub Packages and Maven Central
 on:
   release:
     types: [ created ]
@@ -11,17 +11,19 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-java@v3.11.0
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Required for git-version plugin
+      - uses: actions/setup-java@v4
         with:
           java-version: '8'
           distribution: 'corretto'
       - name: Validate Gradle wrapper
-        uses: gradle/wrapper-validation-action@v1
+        uses: gradle/wrapper-validation-action@v2
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v3
       - name: Verify Javadoc generation
-        uses: gradle/gradle-build-action@v2
-        with:
-          arguments: javadoc
+        run: ./gradlew javadoc
       - name: Check Javadoc generation
         run: |
           if [ -d "build/docs/javadoc" ]; then
@@ -30,15 +32,14 @@ jobs:
             echo "ERROR: Javadoc directory not found"
             exit 1
           fi
-      - name: Publish package
-        uses: gradle/gradle-build-action@v2
-        with:
-          arguments: publish publishToSonatype closeAndReleaseSonatypeStagingRepository
+      - name: Publish to GitHub Packages
+        run: ./gradlew publish
         env:
+          GITHUB_ACTOR: ${{ github.actor }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+      - name: Publish to Maven Central
+        run: ./gradlew publishToMavenCentralPortal
+        env:
+          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
           GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
           GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
-          NEXUS_TOKEN_USERNAME: ${{ secrets.NEXUS_TOKEN_USERNAME }}
-          NEXUS_TOKEN_PASSWORD: ${{ secrets.NEXUS_TOKEN_PASSWORD }}

build.gradle

@@ -15,8 +15,8 @@ plugins {
     id 'signing'
     // the git-version plugin helps us to publish an auto version (taken from git tags)
     id 'com.palantir.git-version' version '0.13.0'
-    // auto release to maven central (skip sonatype manual nexus release process)
-    id("io.github.gradle-nexus.publish-plugin") version "1.1.0"
+    // New Maven Central Portal publishing (replaces legacy OSSRH/Nexus)
+    id 'tech.yanand.maven-central-publish' version '1.2.0'
     // translate json schemas to java classes
 //    id "org.jsonschema2pojo" version "1.1.3"
 }
@@ -151,14 +151,6 @@ dependencies {
 
 publishing {
     repositories {
-        maven {
-            name = "OSSRH"
-            url = "https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/"
-            credentials {
-                username = System.getenv("OSSRH_USERNAME")
-                password = System.getenv("OSSRH_PASSWORD")
-            }
-        }
         maven {
             name = "GitHubPackages"
             url = "https://maven.pkg.github.com/permitio/permit-java"
@@ -169,7 +161,6 @@ publishing {
         }
     }
 
-
     publications {
         maven(MavenPublication) {
             groupId = 'io.permit'
@@ -195,22 +186,22 @@ publishing {
                     }
                 }
                 scm {
+                    connection = 'scm:git:git://github.com/permitio/permit-java.git'
+                    developerConnection = 'scm:git:ssh://github.com/permitio/permit-java.git'
                     url = 'https://github.com/permitio/permit-java'
                 }
             }
         }
     }
 }
 
-nexusPublishing {
-    repositories {
-        sonatype {
-            nexusUrl.set(uri("https://s01.oss.sonatype.org/service/local/"))
-            snapshotRepositoryUrl.set(uri("https://s01.oss.sonatype.org/content/repositories/snapshots/"))
-            username = System.getenv("NEXUS_TOKEN_USERNAME")
-            password = System.getenv("NEXUS_TOKEN_PASSWORD")
-        }
-    }
+// Maven Central Portal publishing configuration
+mavenCentral {
+    repoDir = layout.buildDirectory.dir("staging-deploy")
+    // Token from Maven Central Portal (https://central.sonatype.com/account)
+    authToken = System.getenv("MAVEN_CENTRAL_TOKEN")
+    // Automatically publish after uploading (set to false to manually release)
+    publishingType = "AUTOMATIC"
 }
 
 signing {