fix(ci): publish snapshots to maven.pinont.me repo root

[Pinont]

Why

DevTool CI compiles against https://maven.pinont.me io.github.pinont:singularitylib:2.0.0-SNAPSHOT. Live metadata is stale (lastUpdated 20260828180055; jar singularitylib-2.0.0-20260828.180055-1.jar, 76262 bytes) and is missing APIs now on main (PaginatedMenu, CommandGroup, Attributes, NmsBridge, …).

publish-public-repo (.github/workflows/pages-repo.yml) has failed on every main push since. Latest main failure: https://github.com/Pinont/SingularityLib/actions/runs/33210899386 — job deploy died at Stage maven repo layout. A dispatch from this branch then failed later: https://github.com/Pinont/SingularityLib/actions/runs/33554760652 — Sync artifacts exit 128.

Root cause (verified)

1. Processor not installed. CI log and a local reproduction of the exact deploy command both fail with:
   Could not find artifact io.github.pinont:singularitylib-processor:jar:2.0.0-SNAPSHOT.
   The root pom is a jar (not an aggregator); the processor must be installed locally first, same as build.yml. Fixed in the first commit; dispatch run 33554760652 confirmed Stage maven repo layout: SUCCESS.
2. Wrong clone destination. After mvn deploy, Maven’s target/ is non-empty, so git clone … target would fail. Clone into ${{ runner.temp }}/singularity-maven instead.
3. Wrong sync path. Pinont/singularity-maven gh-pages already has io/ (and com/) at the repo root. Pages source is / with CNAME maven.pinont.me. Copy staging onto that root (accumulative), not into repo/.
4. Push used GITHUB_TOKEN, not MAVEN_REPO_TOKEN. Dispatch 33554760652: clone succeeded, git add/commit succeeded ([gh-pages e4b9e49] publish … 33 files changed — not safe.directory), then git push failed:
   remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/Pinont/singularity-maven.git/'
actions/checkout persist-credentials extraheader injects GITHUB_TOKEN into github.com HTTP. Clone of the public repo still succeeds; push to another repo does not. Fix: persist-credentials: false, reset origin to the PAT URL, blank extraheader on clone/push.

What

Only .github/workflows/pages-repo.yml:

• Install singularitylib-processor before deploy (mirrors build.yml).
• File-deploy processor + lib into staging/.
• Clone singularity-maven gh-pages into runner.temp, overlay staging/. onto the clone root.
• Do not delete /javadoc/, CNAME, .nojekyll, or com/.
• persist-credentials: false on checkout; re-set origin to x-access-token:${MAVEN_REPO_TOKEN} and push with extraheader cleared.
• Concurrency group singularity-maven-gh-pages with cancel-in-progress: false.
• MAVEN_REPO_TOKEN and workflow_dispatch unchanged.

Out of scope

• No push to main, no tags, release.yml / Maven Central untouched.
• Does not merge.
• Does not re-dispatch publish-public-repo (DevOps will re-dispatch after this push).

Verify

• RED (processor): mvn deploy without processor install → same resolution error as run 33210899386.
• GREEN (processor): install processor, then file-deploy processor + lib → exit 0. Staging layout is staging/io/github/pinont/{singularitylib,singularitylib-processor}/… (no repo/ prefix). Overlay onto a fake gh-pages tree preserved CNAME, .nojekyll, javadoc/, and com/.
• RED (push): run 33554760652 logs — commit ok, push auth failed (not safe.directory).
• This workflow does not run on pull_request (by design). After merge or a workflow_dispatch of publish-public-repo, https://maven.pinont.me/io/github/pinont/singularitylib/2.0.0-SNAPSHOT/maven-metadata.xml should refresh.

Note: this PR and #10 both touch pages-repo.yml. #10 only adds the same concurrency group plus a javadoc comment; this PR already includes those so the remaining #10 hunk is redundant.

  

[Copilot]

🟡 Changes recommended

The gh-pages clone fallback can create/publish from the default branch on failure, risking unintended content being pushed to the Pages root.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the publish-public-repo GitHub Actions workflow to correctly publish *-SNAPSHOT artifacts to the root layout served by maven.pinont.me, addressing repeated deployment failures caused by missing local processor installation, incorrect clone destination, incorrect sync path, and credential leakage from actions/checkout.

Changes:

• Installs singularitylib-processor locally and file-deploys both processor + library into a staging repository.
• Switches gh-pages clone destination to ${{ runner.temp }} and overlays staged Maven paths onto the gh-pages repo root (no /repo nesting).
• Disables actions/checkout credential persistence and forces PAT-based auth for git operations, with a shared concurrency group to avoid races.

File summaries

File	Description
.github/workflows/pages-repo.yml	Fixes snapshot publishing flow to correctly stage, overlay, and push Maven repository layout to Pinont/singularity-maven gh-pages with correct credentials and concurrency.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.