feat(build): publish nightly snapshot jars to the ASF Nexus snapshot repository

[adityamparikh]

⚠️ Needs credentials from an ASF committer before this can run: ASF_NEXUS_USERNAME / ASF_NEXUS_PASSWORD repo secrets are not provisioned yet. Eric Pugh or Jan Høydahl (org.apache.solr Nexus deploy rights) need to add them. Until then, the scheduled workflow will fail loudly on every run by design — see "Open question" below.

What / why

This adds a nightly jar publish, the Maven/Gradle-dependency counterpart to the nightly Docker image effort in #218 (not touched here).

Maven Central never accepts SNAPSHOT/nightly artifacts — that's a hard Sonatype/Central platform rule. The ASF-native destination for org.apache.* groupIds (this project is org.apache.solr) is the Apache Nexus snapshot repository at https://repository.apache.org/content/repositories/snapshots.

The project's build.gradle.kts already applies maven-publish and defines a maven publication (group = "org.apache.solr", version = "1.0.0-SNAPSHOT"), but had no repositories {} block — nothing was ever published anywhere but ~/.m2 via publishToMavenLocal. This PR:

1. build.gradle.kts: adds a repositories {} block under publishing {} targeting the ASF Nexus snapshot repository. Credentials are read lazily via providers.environmentVariable("ASF_NEXUS_USERNAME"/"ASF_NEXUS_PASSWORD") — .orNull never throws, so ./gradlew build/test/publishToMavenLocal/etc. all keep working with zero env vars set for every contributor who doesn't have them. Only ./gradlew publish itself fails, loudly and clearly (doFirst check), when credentials are missing — instead of an opaque HTTP 401 deep in the Maven-publish plugin.
2. .github/workflows/nightly-jar.yml: a new scheduled workflow (2 AM UTC, matching ci: publish nightly Docker image to apache/solr-mcp-nightly #218's Docker cron) + workflow_dispatch, guarded to if: github.repository == 'apache/solr-mcp' so forks don't run it. Secret presence is checked inside a run: step (shell [[ -n ... ]]), not inside an if: condition — an earlier nightly workflow attempt in this repo's history (PR ci: remove nightly-build.yml (startup failure from secrets-in-if; unwanted) #155 / issue Figure out Release process #15) referenced secrets.* directly in an if:, which is illegal YAML and caused a permanent parse-time failure with zero jobs ever running. ci: publish nightly Docker image to apache/solr-mcp-nightly #218 already fixed this pattern for the Docker workflow; this PR follows the same fix for the jar workflow.
3. dev-docs/NIGHTLY_JAR.md: new doc (mirrors dev-docs/DOCKER_PUBLISHING.md's style) explaining the flow, how to publish locally, how consumers add the snapshot repository to their own Gradle/Maven build, and — most importantly — the credential gap below.

Open question for Eric Pugh / Jan Høydahl

Not claiming certainty here: it's unconfirmed whether org.apache.solr is already pre-provisioned in ASF's Nexus for this specific sub-project (solr-mcp), the way it presumably is for the main Apache Solr project, or whether that itself needs requesting separately. Whoever provisions the ASF_NEXUS_USERNAME/ASF_NEXUS_PASSWORD secrets should confirm.

Verification

• ./gradlew tasks --all — publish, publishToMavenLocal, publishAllPublicationsToAsfNexusSnapshotsRepository, and publishMavenPublicationToAsfNexusSnapshotsRepository all resolve with no configuration errors.
• ./gradlew spotlessCheck — passes.
• ./gradlew build (full build, JDK 25, Testcontainers/Docker available) — BUILD SUCCESSFUL, all tests including rat, spotlessCheck, and the Testcontainers-based integration tests pass.

Test plan

• ASF committer (Eric Pugh or Jan Høydahl) provisions ASF_NEXUS_USERNAME / ASF_NEXUS_PASSWORD as repo secrets
• Confirm org.apache.solr groupId is provisioned for deploy in ASF Nexus for this sub-project
• Trigger nightly-jar.yml via workflow_dispatch and confirm the artifact appears at https://repository.apache.org/content/repositories/snapshots

🤖 Generated with Claude Code

[adityamparikh]

@epugh @janhoy — nightly jar to the ASF Nexus snapshot repo, the Maven-dependency counterpart to #218's nightly Docker image. Flagging up front: this needs ASF_NEXUS_USERNAME/ASF_NEXUS_PASSWORD repo secrets from whoever has org.apache.solr Nexus deploy rights before it can actually publish — the workflow fails loudly until then, by design. Also open: whether org.apache.solr is already provisioned in ASF Nexus for this sub-project specifically, or needs a separate request. See dev-docs/NIGHTLY_JAR.md.

[janhoy]

I question whether we at all need publishing nightly SNAPSHOT jars anywhere. Users can check out and build the project to obtain those if they don't want to run on an officially released version. Can we simply skip this and simplify things?