From 8a983afdec8d28cfdadb2e7986f932fb16b17ffc Mon Sep 17 00:00:00 2001
From: Thomas Darimont <thomas.darimont@googlemail.com>
Date: Sun, 4 Oct 2026 14:28:43 +0200
Subject: [PATCH] Hand the Central credentials to central.sonatype.com on Maven
 3.10

Maven 3.10 offers the credentials of a settings server only to
repositories declared with that id, and 'central' is also the id of
Maven Central, so the snapshot and release uploads got none and failed
with 401. Both workflows now add central.sonatype.com as a repository
origin of the server setup-java writes.

Closes #17

Signed-off-by: Thomas Darimont <thomas.darimont@googlemail.com>
---
 .github/workflows/ci.yml      | 8 ++++++++
 .github/workflows/release.yml | 8 ++++++++
 CONTRIBUTING.md               | 8 ++++++++
 3 files changed, 24 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 610fc82..3b08ab3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -252,6 +252,14 @@ jobs:
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
+      - name: Scope the Central credentials to central.sonatype.com
+        # Maven 3.10 offers the credentials of a settings server only to repositories declared with
+        # that id, and 'central' is also the id of Maven Central: without this origin the Central
+        # snapshot repository and publisher API get no credentials (401), see CONTRIBUTING.md.
+        run: |
+          sed -i 's|<id>central</id>|<id>central</id><repositoryOrigins><repositoryOrigin>https://central.sonatype.com</repositoryOrigin></repositoryOrigins>|' ~/.m2/settings.xml
+          grep -c '<repositoryOrigin>https://central.sonatype.com</repositoryOrigin>' ~/.m2/settings.xml
+
       - name: Publish snapshots
         # only a snapshot version: on release day main carries the release version for one
         # commit, and that one is published by release.yml from the tag
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1017320..03f8e9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,6 +32,14 @@ jobs:
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
+      - name: Scope the Central credentials to central.sonatype.com
+        # Maven 3.10 offers the credentials of a settings server only to repositories declared with
+        # that id, and 'central' is also the id of Maven Central: without this origin the Central
+        # snapshot repository and publisher API get no credentials (401), see CONTRIBUTING.md.
+        run: |
+          sed -i 's|<id>central</id>|<id>central</id><repositoryOrigins><repositoryOrigin>https://central.sonatype.com</repositoryOrigin></repositoryOrigins>|' ~/.m2/settings.xml
+          grep -c '<repositoryOrigin>https://central.sonatype.com</repositoryOrigin>' ~/.m2/settings.xml
+
       - name: Check that the tag matches the project version
         run: |
           version=$(./mvnw -q -N --no-transfer-progress org.apache.maven.plugins:maven-help-plugin:3.5.1:evaluate -Dexpression=project.version -DforceStdout)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 32fa090..b8dd3cc 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -123,6 +123,14 @@ Snapshots of `main` are published by `ci.yml` to the
 repository variable `PUBLISH_SNAPSHOTS` is `true`. Consumers add that repository with
 `<snapshots><enabled>true</enabled></snapshots>`.
 
+Both workflows let `setup-java` write the `settings.xml` with the Central token as the server
+`central`, and then add `<repositoryOrigins>https://central.sonatype.com</repositoryOrigins>` to that
+server. Maven 3.10 offers the credentials of a settings server only to repositories whose origin it
+can associate with the server id, and `central` is also the id of Maven Central, so without the
+origin the uploads to `central.sonatype.com` get no credentials and fail with `401`. (The alternative,
+`-Dmaven.repository.credentialScope=id`, restores the id-only matching of Maven 3.9 for every
+server.)
+
 To try the release build locally without signing or uploading:
 `./mvnw -Prelease -Dgpg.skip verify`. With the key in the local keyring, set `MAVEN_GPG_PASSPHRASE`
 to sign as well; the passphrase never goes on the command line.