chore: migrate publishing from OSSRH to Central Portal

[ankitdas13]

Summary

• Replaced nexus-staging-maven-plugin with central-publishing-maven-plugin (v0.7.0) to publish via central.sonatype.com
• Updated distributionManagement in pom.xml to point to the new Central Portal
• Added workflow_dispatch trigger for manual publishing from GitHub Actions UI
• Publish job now triggers on both version tags (v*.*.*) and manual dispatch

Required Secrets Setup

Before publishing, configure these GitHub secrets:

Secret	Description
CENTRAL_USERNAME	Token username from central.sonatype.com → Account → Generate User Token
CENTRAL_TOKEN	Token password from central.sonatype.com → Account → Generate User Token
OSSRH_GPG_SECRET_KEY	GPG private key (already exists)
MAVEN_GPG_PASSPHRASE	GPG passphrase (already exists)

Test plan

• Verify CI test job passes
• Add CENTRAL_USERNAME and CENTRAL_TOKEN secrets to the repo
• Trigger publish via workflow_dispatch or push a version tag
• Confirm artifact appears at https://central.sonatype.com/artifact/com.razorpay/razorpay-java

🤖 Generated with Claude Code

[semgrep-code-razorpay]

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🧁 Fixed in commit b2ace4a 🧁

[semgrep-code-razorpay]

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🧼 Fixed in commit b2ace4a 🧼

[semgrep-code-razorpay]

Semgrep found 7 github-actions-mutable-action-tag findings:

• .github/workflows/ci.yml
  • L19 - Triage
  • L22 - Triage
  • L34 - Triage
  • L44 - Triage
  • L47 - Triage
  • L109 - Triage
  • L112 - Triage

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

_{⚪️ This finding does not block your pull request.
Ignore this finding from github-actions-mutable-action-tag}