From 11f93acac9c01c8b0de5f7a8c97b4db0d1fa8d77 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Sun, 11 Oct 2026 18:39:24 +0300
Subject: [PATCH] Fix Maven Central release: pin Maven 3.9.16, bump
 central-publishing to 0.11.0

Maven 3.10 on the runner leaves maven-metadata-local.xml and
_remote.repositories files in the central-publishing staging
directory. They end up in central-bundle.zip, and Maven Central
rejects the release with "Bundle has content that does NOT have a
.pom file". Install Maven 3.9.16 (sha512-verified) before the release
so the bundle stays clean.

Also bump central-publishing-maven-plugin from 0.8.0 to 0.11.0.
0.11.0 alone does not fix the Maven 3.10 issue.

Same workaround as OpenIdentityPlatform/commons#324.
---
 .github/workflows/release.yml | 11 +++++++++++
 pom.xml                       |  4 ++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2c5d17237..340224bae 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,6 +56,17 @@ jobs:
           server-id: ossrh
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
+      # Maven 3.10 leaves maven-metadata-local.xml and _remote.repositories in the
+      # central-publishing staging directory, and Maven Central rejects the bundle.
+      - name: Set up Maven 3.9
+        env:
+          MAVEN_VERSION: 3.9.16
+          MAVEN_SHA512: 831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6
+        run: |
+          curl -fsSL --retry 5 -o "$RUNNER_TEMP/maven.tar.gz" "https://archive.apache.org/dist/maven/maven-3/$MAVEN_VERSION/binaries/apache-maven-$MAVEN_VERSION-bin.tar.gz"
+          echo "$MAVEN_SHA512  $RUNNER_TEMP/maven.tar.gz" | sha512sum -c -
+          tar xzf "$RUNNER_TEMP/maven.tar.gz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/apache-maven-$MAVEN_VERSION/bin" >> "$GITHUB_PATH"
       - name: Cache Maven packages
         uses: actions/cache@v6
         with:
diff --git a/pom.xml b/pom.xml
index cd263417d..916714cc6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -22,7 +22,7 @@
  your own identifying information:
  "Portions Copyrighted [year] [name of copyright owner]"
 
- Portions Copyrighted 2018-2025 3A Systems, LLC
+ Portions Copyrighted 2018-2026 3A Systems, LLC
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <modelVersion>4.0.0</modelVersion>
@@ -327,7 +327,7 @@
             <plugin>
                 <groupId>org.sonatype.central</groupId>
             				<artifactId>central-publishing-maven-plugin</artifactId>
-            				<version>0.8.0</version>
+            				<version>0.11.0</version>
             				<extensions>true</extensions>
             				<configuration>
             				    <publishingServerId>ossrh</publishingServerId>