Repository navigation
fix(java): central-publishing-maven-plugin 0.12.0 so Maven 3.10 staging metadata stays out of the bundle - #451
Merged
Merged
Conversation
…ng metadata stays out of the bundle
… Central rejection
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Changed
central-publishing-maven-pluginfrom0.11.0to0.12.0inserver/java/pom.xml(release profile), so the staged bundle no longer carriesmaven-metadata-local.xmlwritten by Maven 3.10.x on the runner. Without it Central rejects the bundle withBundle has content that does NOT have a .pom file.docs/RELEASING.md(under the Central publish troubleshooting notes) describing the failure: theubuntu-latest(24.04) image ships Maven 3.10.0 from 2026-10-12, the0.11.0plugin left the metadata file in the bundle,0.12.0fixes it, and what to inspect if the signature returns (bundle contents andmvn -von the runner).Validation
Risk Assessment
✅ Low: The change bumps central-publishing-maven-plugin from 0.11.0 to 0.12.0. That plugin is declared at one site only, in the release profile of server/java/pom.xml, so no other module pom pins the old version. The change also adds an accurate troubleshooting note to RELEASING.md. Together these match the stated intent: land on main the fix that published 8.1.0.
Testing
Exercised the one-line plugin bump. Plugin 0.12.0 resolves from Central and the Java reactor validates with it (live, pass). Attempted to reproduce the reported bundle leak with a disposable project and a simulated Maven 3.10 metadata file; the file was absent from the bundle under both 0.11.0 and 0.12.0, so the reproduction failed and the fix is not demonstrated. A real Central publish needs credentials and an outward action, so it was not run. The full repository regression suite was not run. Only the TS baseline and the Java validate step ran. Overall: inconclusive.
Evidence: 0.11.0 bundle publish log (simulated staging, local upload refused)
Evidence: 0.12.0 bundle publish log (simulated staging, local upload refused)
Evidence: Java reactor validate with plugin 0.12.0
Pipeline
Updates from git push no-mistakes
✅ **Intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
✅ **Review** - passed
✅ No issues found.
server/java/pom.xml:468- Could not show the bundle fix works. The intent says Maven 3.10 writes maven-metadata-local.xml into the install target and plugin 0.11.0 leaves it in the bundle. My simulation put that file into the staging dir under both 0.11.0 and 0.12.0 and neither bundle contained it, so the simulation does not reproduce the reported leak. Without a reproduction, 0.12.0 is not shown to fix it. The 8.1.0 publish from fm/java-8-1-0-publish is the only real evidence the bump works. Decide whether that is enough or whether a Maven 3.10.0 bundle repro is required before the next java tag.scripts/ci-local.sh --only ts-fast --only ts-unit --strict-toolchainsgit diff 492decb88..32c423e36 (pom and docs review)mvn -B -Dmaven.repo.local=/tmp/m2-validate/repo org.sonatype.central:central-publishing-maven-plugin:0.12.0:help (live: plugin resolved from Central and goal ran, BUILD SUCCESS)mvn -B -f server/java/pom.xml -DskipTests validate (live: reactor with plugin 0.12.0 validates, log in evidence dir)Disposable project /tmp/bundle-repro: mvn deploy/package then central-publishing:publish with centralBaseUrl=http://127.0.0.1:9 under plugin 0.11.0 and 0.12.0; bundle built, upload refused locally, no Central contact. Simulated maven-metadata-local.xml excluded from bundle under both versions (not reproduced)Baseline: scripts/ci-local.sh --only ts-fast --only ts-unit --strict-toolchains (ran before this phase)✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.
Real-system evidence
On the same runner image (Maven 3.10.0),
java-v8.1.0with plugin 0.11.0 was rejected by Central twice. The same commit plus only this plugin bump published 8.1.0 successfully. The test step's local simulation could not reproduce the leak (verdict inconclusive, approved by the supervisor on that evidence); the 8.1.0 publish is the confirmation.