From fa7105319dba8967ec2af719dc16e2739f8ca5cc Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Sun, 11 Oct 2026 18:39:20 +0300
Subject: [PATCH] Fix Maven Central release: pin Maven 3.9.16, bump
 central-publishing to 0.11.0

Maven 3.10 on the runner leaves maven-metadata-local.xml and
_remote.repositories files in the central-publishing staging
directory. They end up in central-bundle.zip, and Maven Central
rejects the release with "Bundle has content that does NOT have a
.pom file". Install Maven 3.9.16 (sha512-verified) before the release
so the bundle stays clean.

Also bump central-publishing-maven-plugin from 0.8.0 to 0.11.0.
0.11.0 alone does not fix the Maven 3.10 issue.

Same workaround as OpenIdentityPlatform/commons#324.
---
 .github/workflows/release.yml | 11 +++++++++++
 pom.xml                       |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5affe485..c3f253f2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,17 @@ jobs:
           server-id: ossrh
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
+      # Maven 3.10 leaves maven-metadata-local.xml and _remote.repositories in the
+      # central-publishing staging directory, and Maven Central rejects the bundle.
+      - name: Set up Maven 3.9
+        env:
+          MAVEN_VERSION: 3.9.16
+          MAVEN_SHA512: 831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6
+        run: |
+          curl -fsSL --retry 5 -o "$RUNNER_TEMP/maven.tar.gz" "https://archive.apache.org/dist/maven/maven-3/$MAVEN_VERSION/binaries/apache-maven-$MAVEN_VERSION-bin.tar.gz"
+          echo "$MAVEN_SHA512  $RUNNER_TEMP/maven.tar.gz" | sha512sum -c -
+          tar xzf "$RUNNER_TEMP/maven.tar.gz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/apache-maven-$MAVEN_VERSION/bin" >> "$GITHUB_PATH"
       - name: Cache Maven packages
         uses: actions/cache@v5
         with:
diff --git a/pom.xml b/pom.xml
index 3d7f5a8e..09f4ab1a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -880,7 +880,7 @@
 		<plugin>
 			<groupId>org.sonatype.central</groupId>
 			<artifactId>central-publishing-maven-plugin</artifactId>
-			<version>0.8.0</version>
+			<version>0.11.0</version>
 			<extensions>true</extensions>
 			<configuration>
 			    <publishingServerId>ossrh</publishingServerId>