Nightly SNAPSHOT publishing is blocked until ASF Infra provisions Nexus credentials

[andygrove]

What is the problem the feature request solves?

#5902 added the Publish Snapshot workflow, but it cannot actually publish anything until the NEXUS_USER / NEXUS_PW repository secrets exist on apache/datafusion-comet. Both runs so far have failed the same way: the native libraries build, all four jars are assembled and pass the bundled-library check, and then the first mvnw deploy is rejected.

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy (default-deploy)
on project comet-parent-spark3.4_2.12: Failed to deploy artifacts: Could not transfer artifact
org.apache.datafusion:comet-parent-spark3.4_2.12:pom:1.1.0-20260916.034301-1 from/to
apache.snapshots.https (https://repository.apache.org/content/repositories/snapshots):
status code: 401, reason phrase: Unauthorized (401)

• manual dispatch: https://github.com/apache/datafusion-comet/actions/runs/34997359867
• first scheduled run: https://github.com/apache/datafusion-comet/actions/runs/35051253905

It fails on the very first artifact, so nothing partial has been uploaded.

https://issues.apache.org/jira/browse/INFRA-28409 asks Infra to provision the credentials. This issue tracks the work on our side once they do.

Two things are worth knowing while this is open:

• the nightly run will fail every night that main has changed, so the workflow stays red in the Actions tab
• the development installation guide already points people at https://repository.apache.org/content/repositories/snapshots/org/apache/datafusion/, which has nothing in it yet

Describe the potential solution

When INFRA-28409 is resolved:

1. dispatch Publish Snapshot manually and confirm all four variants (comet-spark-spark3.4_2.12, comet-spark-spark3.5_2.12, comet-spark-spark4.0_2.13, comet-spark-spark4.1_2.13) appear in the snapshot repository along with the parent poms consumers need to resolve them
2. resolve one of the published jars into a clean local ~/.m2 and run a trivial query with it, to confirm it is usable end to end and that both linux/amd64 and linux/aarch64 libraries load
3. let the next scheduled run complete unattended, and confirm the "skip when main has not changed" branch behaves on a quiet night

If Infra provisions something other than what the workflow assumes — a publishing token rather than a username/password pair, or a server id other than apache.snapshots.https — the ~/.m2/settings.xml step in the workflow needs to change to match.

We could also disable the schedule until the secrets land, to keep the nightly failures out of the way. It seems better to leave it running as a reminder, but I don't feel strongly about it.

Additional context

• Workflow: .github/workflows/publish_snapshot.yml
• Original feature request: Publish nightly SNAPSHOT jars to repository.apache.org #5899
• Implementation: ci: publish nightly SNAPSHOT jars to repository.apache.org #5902
• INFRA ticket: https://issues.apache.org/jira/browse/INFRA-28409