Repository navigation
Fix snapshot and release publishing with Maven 3.10 credential scoping - #3940
Merged
Merged
Conversation
Maven 3.10 binds server credentials to repository origins, and the server id "central" is implicitly bound to https://repo.maven.apache.org only. The Sonatype token was therefore no longer sent to central.sonatype.com and publishing failed with HTTP 401. Use a committed settings file that declares https://central.sonatype.com as an allowed origin for the "central" server, in both the snapshot and release workflows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Snapshot publishing has failed with HTTP 401 since the
ubuntu-24.04runner image moved from Maven 3.9.16 to 3.10.0. Maven 3.10 ties server credentials to repository origins. Because the server idcentralmaps tohttps://repo.maven.apache.orgonly, Maven stopped sending the Sonatype token tocentral.sonatype.com. This PR declares the Sonatype origin explicitly, so both the snapshot and release workflows publish again.Key Decisions & Assumptions
.github/maven-settings.xmlreplaces the server entry thatsetup-javagenerated, becausesetup-javacannot emit<repositoryOrigins>.https://central.sonatype.com, instead of falling back to-Dmaven.repository.credentialScope=id. This keeps Maven 3.10's origin scoping in place.MAVEN_USERNAME/MAVEN_PASSWORD, which come from the same secrets as before.Behavioral / Conceptual Changes
deploystep and the releasePublish to Mavenstep now run with--settings .github/maven-settings.xml.setup-javano longer configures thecentralserver in either workflow.Notes
centralcredentials. Also checked that the Maven 3.10.0 source adds<repositoryOrigins>entries to the allowed origins. Not yet verified end-to-end on CI; after merging, trigger "Publish Snapshot" manually and confirm the "Not using credentials of server 'central'" warning is gone.🤖 Generated with Claude Code
Note
Low Risk
CI-only Maven settings and workflow wiring; no application runtime or secret handling changes beyond fixing where credentials are applied during deploy.
Overview
Restores snapshot and release publishing after Maven 3.10 on
ubuntu-lateststopped sending Sonatype credentials tocentral.sonatype.com, which caused HTTP 401s.Adds a committed
.github/maven-settings.xmlthat defines thecentralserver withMAVEN_USERNAME/MAVEN_PASSWORDand explicitly scopes credentials tohttps://central.sonatype.comvia<repositoryOrigins>. Snapshot and releasedeploysteps now pass--settings .github/maven-settings.xml, and both workflows dropsetup-java’sserver-id/ username / password options because that action cannot emit the origins block.Reviewed by Cursor Bugbot for commit 0f8d9d1. Bugbot is set up for automated code reviews on this repo. Configure here.