Fix Maven Central release: pin Maven 3.9.16, bump central-publishing to 0.1...

Valery Kharseko

20 hours ago 5b210f310f313b4170c6c9ab04e9642809d789b6

Fix Maven Central release: pin Maven 3.9.16, bump central-publishing to 0.11.0 (#1187)

Refs OpenIdentityPlatform/commons#325 (workaround only, the issue stays
open)

## Problem

Since the `ubuntu-24.04` runner image 20261004 replaced the system Maven
3.9.x with 3.10.0, releases to Maven Central fail in validation:

```
Bundle has content that does NOT have a .pom file: <every artifact directory>
```

Under Maven 3.10, `central-publishing-maven-plugin` leaves
local-repository files in its staging directory, and they end up in
`central-bundle.zip`:

- `maven-metadata-local.xml` in every artifact directory
- `_remote.repositories` (+ checksums) in every version directory

This first hit OpenIdentityPlatform/commons in release run
[38121296549](https://github.com/OpenIdentityPlatform/commons/actions/runs/38121296549).
The commons issue has the local reproduction and the upstream links.
Plugin 0.8.0 and 0.11.0 behave the same.

## Changes

Same workaround as OpenIdentityPlatform/commons#324:

- `release.yml`: before the release, install Maven 3.9.16 from
`archive.apache.org` with a pinned sha512 and put it first on `PATH`.
`release:perform` runs its nested build with the same Maven.
- `pom.xml`: bump `central-publishing-maven-plugin` from 0.8.0 to
0.11.0. On its own, 0.11.0 does not fix the Maven 3.10 issue.

 .github/workflows/release.yml

@@ -62,6 +62,17 @@
          server-id: ossrh
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
      # Maven 3.10 leaves maven-metadata-local.xml and _remote.repositories in the
      # central-publishing staging directory, and Maven Central rejects the bundle.
      - name: Set up Maven 3.9
        env:
          MAVEN_VERSION: 3.9.16
          MAVEN_SHA512: 831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6
        run: |
          curl -fsSL --retry 5 -o "$RUNNER_TEMP/maven.tar.gz" "https://archive.apache.org/dist/maven/maven-3/$MAVEN_VERSION/binaries/apache-maven-$MAVEN_VERSION-bin.tar.gz"
          echo "$MAVEN_SHA512  $RUNNER_TEMP/maven.tar.gz" | sha512sum -c -
          tar xzf "$RUNNER_TEMP/maven.tar.gz" -C "$RUNNER_TEMP"
          echo "$RUNNER_TEMP/apache-maven-$MAVEN_VERSION/bin" >> "$GITHUB_PATH"
      - name: Cache Maven packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:

 pom.xml

@@ -342,7 +342,7 @@
            <plugin>
                <groupId>org.sonatype.central</groupId>
                <artifactId>central-publishing-maven-plugin</artifactId>
                <version>0.8.0</version>
                <version>0.11.0</version>
                <extensions>true</extensions>
                <configuration>
                    <publishingServerId>ossrh</publishingServerId>