fix(release): publish a bundle Maven Central accepts

.github/workflows/ci.yml

@@ -25,6 +25,7 @@ env:
     -Daether.connector.http.connectionMaxTtl=25
     -Dmaven.artifact.threads=8
 
+# Maven runs as ./mvnw, the version .mvn/wrapper pins, so a runner image update cannot change the build.
 jobs:
   validate:
     name: Code Quality & Security
@@ -50,19 +51,19 @@ jobs:
           timeout_minutes: 10
           max_attempts: 2
           retry_wait_seconds: 30
-          command: mvn clean validate compile -B --no-transfer-progress -DskipTests
+          command: ./mvnw clean validate compile -B --no-transfer-progress -DskipTests
 
       # The quality profile's execution, which fails on a warning; a bare dependency:analyze only warns.
       - name: Verify Dependencies
         run: |
-          mvn test-compile dependency:analyze-only@analyze-dependencies -B --no-transfer-progress -Pquality
-          mvn dependency:tree -B --no-transfer-progress | tee dependency-tree.txt
+          ./mvnw test-compile dependency:analyze-only@analyze-dependencies -B --no-transfer-progress -Pquality
+          ./mvnw dependency:tree -B --no-transfer-progress | tee dependency-tree.txt
 
       - name: Code Style Check (Spotless)
-        run: mvn spotless:check -B --no-transfer-progress
+        run: ./mvnw spotless:check -B --no-transfer-progress
 
       - name: Security Analysis (SpotBugs)
-        run: mvn spotbugs:check -B --no-transfer-progress
+        run: ./mvnw spotbugs:check -B --no-transfer-progress
 
       - name: Upload Dependency Tree
         uses: actions/upload-artifact@v7
@@ -102,7 +103,7 @@ jobs:
           timeout_minutes: 20
           max_attempts: 3
           retry_wait_seconds: 30
-          command: mvn clean verify -B --no-transfer-progress -Djava.version=${{ matrix.java }}
+          command: ./mvnw clean verify -B --no-transfer-progress -Djava.version=${{ matrix.java }}
 
       - name: Upload coverage reports to Codecov
         if: matrix.java == 17
@@ -162,7 +163,7 @@ jobs:
       # Online, Trivy fetches the dependencies' poms from Maven Central, which rate-limits it (429) and
       # fails the scan. Maven puts them in ~/.m2 instead, where Trivy's offline scan finds them.
       - name: Resolve Dependencies for Security Scan
-        run: for pom in pom.xml examples/*/pom.xml; do mvn dependency:tree -B --no-transfer-progress -q -f "$pom"; done
+        run: for pom in pom.xml examples/*/pom.xml; do ./mvnw dependency:tree -B --no-transfer-progress -q -f "$pom"; done
 
       - name: Run Trivy Scan
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -227,7 +228,7 @@ jobs:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: 'temurin'
           cache: maven
-          server-id: central
+          server-id: central-portal
           server-username-env-var: CENTRAL_TOKEN_USERNAME
           server-password-env-var: CENTRAL_TOKEN_PASSWORD
       # Imports the signing key and gives gpg-agent its passphrase.
@@ -237,10 +238,10 @@ jobs:
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
       - if: steps.central.outputs.published != 'true'
-        run: mvn -B --no-transfer-progress org.codehaus.mojo:versions-maven-plugin:2.23.0:set -DnewVersion="$V" -DgenerateBackupPoms=false
+        run: ./mvnw -B --no-transfer-progress org.codehaus.mojo:versions-maven-plugin:2.23.0:set -DnewVersion="$V" -DgenerateBackupPoms=false
       # Signs, uploads to the Central Portal, and waits until it is published.
       - if: steps.central.outputs.published != 'true'
-        run: mvn clean deploy -B --no-transfer-progress -Pmaven-central-release -DskipTests -Dgpg.keyname="$GPG_KEY_ID"
+        run: ./mvnw clean deploy -B --no-transfer-progress -Pmaven-central-release -DskipTests -Dgpg.keyname="$GPG_KEY_ID"
         env:
           CENTRAL_TOKEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
           CENTRAL_TOKEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}

.mvn/wrapper/maven-wrapper.properties

@@ -1,19 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce

pom.xml

@@ -65,7 +65,7 @@
         <maven-deploy-plugin.version>3.1.4</maven-deploy-plugin.version>
         <maven-dependency-plugin.version>3.8.1</maven-dependency-plugin.version>
         <maven-gpg-plugin.version>3.2.7</maven-gpg-plugin.version>
-        <central-publishing-maven-plugin.version>0.7.0</central-publishing-maven-plugin.version>
+        <central-publishing-maven-plugin.version>0.12.0</central-publishing-maven-plugin.version>
     </properties>
 
     <dependencyManagement>
@@ -530,28 +530,17 @@
         <!-- Maven Central Release Profile -->
         <profile>
             <id>maven-central-release</id>
-            <distributionManagement>
-                <repository>
-                    <id>central</id>
-                    <name>Central Repository</name>
-                    <url>https://central.sonatype.com/api/v1/publisher</url>
-                </repository>
-                <snapshotRepository>
-                    <id>central</id>
-                    <name>Central Repository Snapshots</name>
-                    <url>https://central.sonatype.com/repository/maven-snapshots/</url>
-                </snapshotRepository>
-            </distributionManagement>
             <build>
                 <plugins>
-                    <!-- Central Publishing Maven Plugin -->
+                    <!-- Central Publishing Maven Plugin: deploys in place of maven-deploy-plugin, so the profile needs no distributionManagement -->
                     <plugin>
                         <groupId>org.sonatype.central</groupId>
                         <artifactId>central-publishing-maven-plugin</artifactId>
                         <version>${central-publishing-maven-plugin.version}</version>
                         <extensions>true</extensions>
                         <configuration>
-                            <publishingServerId>central</publishingServerId>
+                            <!-- Not central, the id of the repository Maven downloads from, so Maven never offers the Portal token there -->
+                            <publishingServerId>central-portal</publishingServerId>
                             <autoPublish>true</autoPublish>
                             <waitUntil>published</waitUntil>
                             <checksums>required</checksums>