ci(maven): groupId -> com.vibetensor + Central Portal publish workflow

[ascender1729]

Fixes groupId to the verified com.vibetensor namespace + switches to the Central Portal publisher (vanniktech). Tag-triggered, secrets via GitHub UI. After merge + GPG/token secrets added, push v0.4.0 to publish com.vibetensor:attestix:0.4.0.

Summary by CodeRabbit

• Chores
  • Added automated publishing workflow to Maven Central triggered on version tag pushes.
  • Updated Maven publishing configuration to use Central Portal with automatic release capability.
  • Breaking Change: Maven coordinates updated; library users must update their dependency references accordingly.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR establishes automated Maven Central publishing by migrating the Gradle build from legacy OSSRH publishing to the com.vanniktech.maven.publish Central Portal plugin and adds a GitHub Actions workflow to trigger publishing on version tag pushes with version validation and test execution.

Changes

Maven Central Publishing Setup

Layer / File(s)	Summary
Gradle Maven publishing configuration build.gradle.kts	Project groupId updated from io.vibetensor to com.vibetensor; legacy maven-publish and signing plugins and OSSRH repository configuration replaced with com.vanniktech.maven.publish plugin targeting SonatypeHost.CENTRAL_PORTAL with automaticRelease = true and signAllPublications() enabled; POM metadata (licenses, developers, SCM, project name/description/URL) now configured inline within the plugin's mavenPublishing block instead of separate publishing and signing blocks.
Publishing automation workflow .github/workflows/publish.yml	New GitHub Actions workflow triggered on version tag pushes matching v*.*.* pattern and manual dispatch; workflow environment setup includes Temurin JDK 17 and Gradle; includes validation step that strips leading v from tag and verifies version matches build.gradle.kts; runs full test suite before publishing to Maven Central via publishToMavenCentral task using Maven Central credentials and GPG signing secrets with configuration cache disabled.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 A maven path through Central's door,
From io to vibetensor's core,
With tags that dance and tests that flow,
The artifacts find where they should go! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the two primary changes: correcting the Maven groupId to com.vibetensor and switching to Central Portal publishing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/maven-central-publish

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/publish.yml (1)

44-45: 💤 Low value

Consider disabling Gradle cache for publishing workflow security.

The gradle/actions/setup-gradle action enables caching by default, which static analysis flagged as a cache-poisoning vector. For tag-triggered publishing workflows, the risk is lower than for PR workflows, but disabling caching provides defense-in-depth for a critical release pipeline.

🔧 Proposed fix to disable caching

 # gradle/actions/setup-gradle v4.2.2
- uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b
+ with:+ cache-disabled: true

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 44 - 45, The gradle setup step
currently uses the action reference
"gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b" which
enables caching by default; update that step to explicitly disable the action's
cache input (e.g., add the action input key "cache" set to false) so the
setup-gradle step no longer creates or restores Gradle caches for the
publish/tag workflow.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 35-36: The checkout step using
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 should disable
credential persistence; update the checkout step (the step that uses
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5) to include with:
persist-credentials: false so Git credentials are not stored in the workspace
during the GPG signing workflow.
---
Nitpick comments:
In @.github/workflows/publish.yml:
- Around line 44-45: The gradle setup step currently uses the action reference
"gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b" which
enables caching by default; update that step to explicitly disable the action's
cache input (e.g., add the action input key "cache" set to false) so the
setup-gradle step no longer creates or restores Gradle caches for the
publish/tag workflow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f5503ede-720a-445f-a3ca-670b8e13e74e

📥 Commits

Reviewing files that changed from the base of the PR and between 721924b and b61e48b.

📒 Files selected for processing (2)

• .github/workflows/publish.yml
• build.gradle.kts

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Disable credential persistence for improved security posture.

In a workflow handling GPG signing keys, setting persist-credentials: false prevents Git credentials from being stored in the workspace, reducing the attack surface.

🛡️ Proposed fix

 # actions/checkout v4.3.0
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+ with:+ persist-credentials: false

📝 Committable suggestion

‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	# actions/checkout v4.3.0
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
	# actions/checkout v4.3.0
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
	with:
	persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 35 - 36, The checkout step using
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 should disable
credential persistence; update the checkout step (the step that uses
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5) to include with:
persist-credentials: false so Git credentials are not stored in the workspace
during the GPG signing workflow.