SK-3002 stop publishing build-internal jars to Maven Central

[Devesh-Skyflow]

Problem

The flowvault/v1.0.0 bundle staged 11 files. Two of them are build-internal and were about to become permanent public classifiers:

skyflow-flowvault-java-1.0.0-tests.jar
skyflow-flowvault-java-1.0.0-with-common.jar

Both for the same reason: they are attached as secondary artifacts, and deploy uploads every attached artifact.

-with-common

This is the japicmp comparison jar. skyvault/pom.xml already called it "comparison-only" — but shadedArtifactAttached is precisely what attaches it, so the documented intent was never actually enforced.

Replaced with shade's <outputFile>, which writes the jar and neither replaces the main artifact nor attaches it. The output path is deliberately unchanged, so the japicmp newVersion path needs no edit.

-tests

From the root pom's maven-jar-plugintest-jar execution, inherited by every module. Nothing in the repo consumes a test-jar — there is no <type>test-jar</type> dependency anywhere — and the release build's tests run in-module, so the execution is removed.

Correction: excludeArtifacts does not work for this

I suggested excludeArtifacts as the fix in #402. That was wrong and I want it on the record. Its filter compares against Artifact.getArtifactId(), not the classifier — from 0.11.0's PublishMojo bytecode:

lambda$processRelease$1(ArtifactWithFile):
getfieldexcludeArtifactsArtifactWithFile.getArtifact().getArtifactId() // ← artifactId, not classifierList.contains(...)

-tests and -with-common share the artifactId skyflow-flowvault-java with the main jar, so listing it would have dropped the artifact you are publishing. excludeArtifacts is for skipping a whole module in a multi-module build, not for pruning classifiers.

This PR therefore does not depend on #402 and is based directly on main.

Verification

mvn clean install across the whole repo. Every module now attaches exactly jar + sources + javadoc:

Installing common/target/common-1.0.0.jar
Installing common/target/common-1.0.0-sources.jar
Installing common/target/common-1.0.0-javadoc.jar
--- japicmp-maven-plugin:0.26.0:cmp @ skyflow-java ---
Installing skyvault/target/skyflow-java-2.1.1.jar
Installing skyvault/target/skyflow-java-2.1.1-sources.jar
Installing skyvault/target/skyflow-java-2.1.1-javadoc.jar
--- japicmp-maven-plugin:0.26.0:cmp @ skyflow-flowvault-java ---
Installing flowvault/target/skyflow-flowvault-java-1.0.0.jar
Installing flowvault/target/skyflow-flowvault-java-1.0.0-sources.jar
Installing flowvault/target/skyflow-flowvault-java-1.0.0-javadoc.jar
BUILD SUCCESS

No -tests, no -with-common attached anywhere. japicmp:cmp still runs and passes for both modules, and target/*-with-common.jar is still produced on disk for it (confirmed on a clean build).

Two observations, not changed here

1. -with-common is redundant for flowvault. Each module has a second, id-less shade execution that replaces the main artifact with a fat jar including common. So the main jar and the comparison jar are content-identical:

jar	contains common/Credentials.class	classes
skyflow-flowvault-java-1.0.0.jar	yes	353
skyflow-flowvault-java-1.0.0-with-common.jar	yes	353
original-skyflow-flowvault-java-1.0.0.jar	no	253

japicmp could point at the main jar and the extra shade execution could go entirely. Left alone as a behavioural change beyond this fix.

2. Both module poms declare maven-shade-plugin twice, which is the source of this warning on every build, already visible in the release logs:

[WARNING] 'build.plugins.plugin.(groupId:artifactId)' must be unique but found duplicate
declaration of plugin org.apache.maven.plugins:maven-shade-plugin
[WARNING] ... future Maven versions might no longer support building such malformed projects.

Merging them into one declaration with two executions would fix both this and (1).

Timing

Worth merging before clicking Publish on the staged 1.0.0 deployment — otherwise those two classifiers are permanent. If the current deployment is already staged with them, it needs a Drop and a re-run rather than a Publish.

🤖 Generated with Claude Code

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep Findings: Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.30%. Comparing base (bf4bac4) to head (235ac2d).

Additional details and impacted files

@@ Coverage Diff @@## main #404 +/- ##
==========================================
Coverage 91.30% 91.30% - Complexity 0 454 +454 
==========================================
Files 157 157 Lines 6392 6392 Branches 850 850 ==========================================
Hits 5836 5836 Misses 364 364 Partials 192 192 

Flag	Coverage Δ
common	88.38% <ø> (ø)
flowvault	88.65% <ø> (ø)
skyvault	94.72% <ø> (ø)
unittests-flowvault	89.67% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
Module: common	88.38% <ø> (ø)
Module: skyvault	94.72% <ø> (ø)
Module: flowvault	88.65% <ø> (ø)
Service Account	86.69% <ø> (ø)
Vault Data	91.42% <ø> (ø)
Vault Tokens	99.03% <ø> (ø)
Vault Connection	100.00% <ø> (ø)
Vault Controller	85.31% <ø> (ø)
Detect	100.00% <ø> (ø)
Audit	100.00% <ø> (ø)
BIN Lookup	100.00% <ø> (ø)
Config	96.26% <ø> (ø)
Utils	89.21% <ø> (ø)
Errors	100.00% <ø> (ø)
Enums	100.00% <ø> (ø)
Logs	95.32% <ø> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bf4bac4...235ac2d. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Devesh-Skyflow]

Consolidated into #402 so the release fix lands as one PR — the commit is cherry-picked there unchanged (c8a8d38), and #402's description now covers both the 0.11.0 bump and the internal-jars fix. The combined branch is verified with a full mvn clean install.