support central-publishing-maven-plugin for detectSkip

[hboutemy]

New feature, improvement proposal

detectSkip detectes skipped sub-projects by checking skipped deploy using https://github.com/apache/maven-artifact-plugin/blob/master/src/main/java/org/apache/maven/plugins/artifact/buildinfo/PluginUtil.java

the new Maven Central publishing approach promoting central-publishing-maven-plugin de-facto marks everything as "skip deploy" to replace the upload step with its own approach: then projects that migrate to this approach are detected to skip absolutely everything...

skipModules requires a specific check with this plugin

[hboutemy]

Reproducible Central checks on such case requires disabling detectSkip https://github.com/search?q=repo%3Ajvm-repo-rebuild%2Freproducible-central+buildinfo.detect.skip%3Dfalse&type=code

and eventually configure manual skip https://github.com/search?q=repo%3Ajvm-repo-rebuild%2Freproducible-central+buildinfo.detect.skip%3Dfalse+buildinfo.skipModules&type=code

[hboutemy]

exemple: gson https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/content/com/google/code/gson/README.md

• up to 2.13.1: use OSSRH, with classical deploy, and configuration is modules not to be deployed https://github.com/google/gson/blob/gson-parent-2.13.1/extras/pom.xml#L36 that deactivate deploy plugin https://github.com/google/gson/blob/gson-parent-2.13.1/pom.xml#L379

• in 2.13.2-rc1, Migrate from OSSRH to Central google/gson#2892 did a first experimental pass google/gson@fa62c15 to switch to central-publishing-maven-plugin https://github.com/google/gson/blob/gson-parent-2.13.2-rc1/pom.xml#L378 which failed to disable modules publication like gson-extras https://central.sonatype.com/artifact/com.google.code.gson/gson-extras/versions and proto https://central.sonatype.com/artifact/com.google.code.gson/proto/versions

• in 2.13.2, changed project approach to disable unwanted publication of some modules Switch to using central-publishing-maven-plugin. google/gson#2900 with a hack (change phase of central-publishing-maven-plugin)

[hboutemy]

in 2.13.2-rc1, it seems skipPublishing parameter from central-publishing-maven-plugin 0.8.0 had a bug, that should be fixed in 0.9.0 https://central.sonatype.org/publish/publish-portal-maven/#090 (2025-09-23 https://central.sonatype.com/artifact/org.sonatype.central/central-publishing-maven-plugin/versions )

but 2.13.2 changed the approach, by changing phase: this makes the discovery of configuration really hard, as shown by buildplan:list:

[INFO] --- buildplan:2.2.2:list (default-cli) @ gson-extras ---
[INFO] Build Plan for Gson Extras: 
-------------------------------------------------------------------------------------------------
PHASE                  | PLUGIN                 | VERSION | GOAL          | EXECUTION ID         
-------------------------------------------------------------------------------------------------
validate               | maven-enforcer-plugin  | 3.6.1   | enforce       | enforce-versions     
process-resources      | maven-resources-plugin | 3.3.1   | resources     | default-resources    
compile                | maven-compiler-plugin  | 3.14.0  | compile       | default-compile      
process-test-resources | maven-resources-plugin | 3.3.1   | testResources | default-testResources
test-compile           | maven-compiler-plugin  | 3.14.0  | testCompile   | default-testCompile  
test                   | maven-surefire-plugin  | 3.5.3   | test          | default-test         
package                | maven-jar-plugin       | 3.4.2   | jar           | default-jar          
package                | maven-source-plugin    | 3.3.1   | jar-no-fork   | attach-sources       
package                | maven-javadoc-plugin   | 3.11.3  | jar           | attach-javadocs      
verify                 | spotless-maven-plugin  | 2.46.1  | check         | default              
verify                 | maven-artifact-plugin  | 3.6.0   | buildinfo     | default              
verify                 | maven-gpg-plugin       | 3.2.8   | sign          | sign-artifacts       
install                | maven-install-plugin   | 3.1.4   | install       | default-install      

what we need to discover here is that neither deploy plugin nor central-publishing-maven-plugin are listed

what a mess...