Publishing a Java Library to Maven Central with Gradle

Publishing to Maven Central is more involved than publishing to an internal Nexus because Sonatype enforces strict requirements that most internal registries do not — complete POM metadata, sources JAR, Javadoc JAR, and GPG signatures on every artifact.

The three required plugins

• maven-publish defines the publication and POM metadata — license, developer, SCM URL are all required by Sonatype's validation; a missing field fails the staging close step after upload
• signing applies GPG signatures to every artifact; without signatures, Sonatype rejects the staging repository
• io.github.gradle-nexus.publish-plugin automates the Sonatype staging workflow: it creates a staging repository, uploads, closes, and releases in sequence without manual Sonatype UI interaction

Sources and Javadoc — the most commonly missed requirement

• Call java.withSourcesJar() and java.withJavadocJar() in the java {} block — without these, the upload succeeds but staging close fails because Sonatype's validation rejects the incomplete submission
• Sonatype requires the sources JAR so that IDEs can show source code for library consumers; the Javadoc JAR enables documentation lookup
• The staging close failure message is not always obvious — running with --info exposes the exact validation error from Sonatype's API response

CI release workflow

• GPG private key and OSSRH credentials must be environment variables in CI — useInMemoryPgpKeys(findProperty("signingKey"), findProperty("signingPassword")) reads the key from a property that CI sets from a secret; no GPG keyring needed on the CI runner
• Tie releases to Git tags: pushing v1.0.0 triggers the CI pipeline that runs the full publish-close-release sequence; no manual steps
• Always publish a snapshot to https://s01.oss.sonatype.org/content/repositories/snapshots first to verify the pipeline works before attempting the first production release