[ci] deploy-to-maven-central fails after update to maven 3.10.0 #7153

Activity

1. pzygielo commented on Oct 6, 2026

   

   pzygielo

   on Oct 6, 2026

   Last edited by pzygielo

   Contributor

   More actions

   or something?

   (in other project) with maven 3.10.0 I had to add -Dmaven.repository.credentialScope=id

   But I can't see anything like

   [WARNING] Not using credentials of server central for repository
     https://central.sonatype.com/repository/maven-snapshots/:
     the origins declared for this id are [https://repo.maven.apache.org].
     Add https://central.sonatype.com to <repositoryOrigins> of that server
     in settings if these credentials belong there, or set
       maven.repository.credentialScope=id
     to restore legacy id-only credential matching.
   

   in linked build so it's possible it is not the impact of apache/maven#12954...~

   Correction - I see it now: https://github.com/pmd/pmd/actions/runs/37220750624/job/111490468498#step:6:128
2. UncleOwen commented on Oct 6, 2026

   

   UncleOwen

   on Oct 6, 2026

   MemberAuthor

   More actions

   @pzygielo Thanks, that's very likely it.
3. adangel commented on Oct 6, 2026

   

   adangel

   on Oct 6, 2026

   Member

   More actions

   See actions/setup-java#1282 for the fix in setup java.

   How the deployment works here:

   • setup-java configures a settings.xml with the properties from here:

     pmd/.github/workflows/publish-release.yml

     Lines 93 to 101 in 732214e

     	- uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 #v6.0.1
     	with:
     	distribution: 'temurin'
     	java-version: '21'
     	server-id: central
     	server-username-env-var: MAVEN_USERNAME
     	server-password-env-var: MAVEN_PASSWORD
     	gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
     	gpg-private-key: ${{ secrets.PMD_CI_GPG_PRIVATE_KEY }}

   • server-id is important. It is "central" and has to match with that one:

     pmd/pom.xml

     Line 866 in 732214e

     <publishingServerId>central</publishingServerId>

   • the generated settings.xml uses env vars for username/password (MAVEN_USERNAME and MAVEN_PASSWORD)
   • these env vars are injected via secrets:

     pmd/.github/workflows/publish-release.yml

     Lines 109 to 110 in 732214e

     	MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_PORTAL_USERNAME }}
     	MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PORTAL_PASSWORD }}

   • these secrets are configured for the environment "maven-central":

     pmd/.github/workflows/publish-release.yml

     Lines 79 to 81 in 732214e

     	environment:
     	name: maven-central
     	url: https://repo.maven.apache.org/maven2/net/sourceforge/pmd/

   The generated settings.xml looks roughly like this:

   <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
     <interactiveMode>false</interactiveMode>
     <servers>
       <server>
         <id>central</id>
         <username>${env.MAVEN_USERNAME}</username>
         <password>${env.MAVEN_PASSWORD}</password>
       </server>
     </servers>
   <!-- plus some profiles -->
   </settings>

   (generated at https://github.com/actions/setup-java/blob/d0e6e4dbf773b98efde945f446d2099b2c0d8fd2/src/auth.ts#L285)
4. adangel

   added

   in:pmd-internalsAffects PMD's internalsAffects PMD's internals

   github_actionsPull requests that update Github_actions codePull requests that update Github_actions code

   on Oct 15, 2026
5. adangel

   added this to the 7.29.0 milestone on Oct 15, 2026
6. adangel

   changed the title [-]deploy-to-maven-central keeps failing[/-] [+][ci] deploy-to-maven-central fails after update to maven 3.10.0[/+] on Oct 15, 2026
7. adangel

   closed this as completedin #7190on Oct 15, 2026
8. adangel

   added a commit that references this issue on Oct 16, 2026

   chore(deps): bump actions/setup-java from 6.0.1 to 6.1.0 (pmd#7190)

   ...

   This issue will close once commit 66860e2 is merged into the 'main' branch.

   66860e2