Fix Gradle 8.x task dependency and duplicate artifact issues

- Add task dependency fix for plainJavadocJar -> generateMetadataFileForMavenPublication
- Remove duplicate withSourcesJar/withJavadocJar (handled by vanniktech plugin)
- Add -PskipSigning flag for local testing without GPG keys
- Update PUBLISHING.md with skipSigning documentation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: zeevmoney

PUBLISHING.md

@@ -62,11 +62,13 @@ The workflow (`.github/workflows/publish.yaml`) handles:
 Test artifact generation without uploading:
 
 ```bash
-./gradlew publishToMavenLocal
+./gradlew publishToMavenLocal -PskipSigning
 ```
 
 Artifacts are published to `~/.m2/repository/io/permit/permit-sdk-java/`
 
+Note: Use `-PskipSigning` for local testing without GPG keys. This flag is not available for Maven Central publishing (signing is required).
+
 #### Publish to Maven Central (Staging Only)
 
 Upload to Central Portal without releasing:

build.gradle

@@ -37,10 +37,7 @@ java {
     toolchain {
         languageVersion = JavaLanguageVersion.of(8)
     }
-    // sources are required by maven central in order to accept the package
-    withSourcesJar()
-    // javadoc jar is required by maven central in order to accept the package
-    withJavadocJar()
+    // Note: sources and javadoc JARs are created by the vanniktech maven-publish plugin
 }
 
 // package dependencies
@@ -152,8 +149,11 @@ mavenPublishing {
     // Publish to Maven Central Portal (new system replacing OSSRH)
     publishToMavenCentral(com.vanniktech.maven.publish.SonatypeHost.CENTRAL_PORTAL)
 
-    // Sign all publications with GPG
-    signAllPublications()
+    // Sign all publications with GPG (required for Maven Central)
+    // For local testing without GPG, use: ./gradlew publishToMavenLocal -PskipSigning
+    if (!project.hasProperty('skipSigning')) {
+        signAllPublications()
+    }
 
     // Artifact coordinates
     coordinates("io.permit", "permit-sdk-java", version.toString())
@@ -218,3 +218,9 @@ tasks.named('jar') {
         attributes('Implementation-Title': project.name, 'Implementation-Version': project.version)
     }
 }
+
+// Fix Gradle 8.x task dependency validation issue with vanniktech plugin
+// The plainJavadocJar task must run before generateMetadataFileForMavenPublication
+tasks.withType(GenerateModuleMetadata).configureEach {
+    dependsOn tasks.matching { it.name == 'plainJavadocJar' }
+}