From f95bbb472300d6c9275c0ad7ae87df68da3d8219 Mon Sep 17 00:00:00 2001
From: Aaron Coburn <aaronc@inrupt.com>
Date: Wed, 4 Nov 2026 15:13:27 -0600
Subject: [PATCH] Bind Sonatype credentials to central.sonatype.com origin

Maven 3.10 binds server credentials to repository origins, and the
'central' server id defaults to https://repo.maven.apache.org. As a
result, credentials were withheld from uploads to central.sonatype.com
and the deploy step failed with HTTP 401.

Add a committed settings file that declares the Sonatype origin via
<repositoryOrigins> and use it for the deploy step. setup-java cannot
generate this element, so it no longer writes settings.xml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/maven-settings.xml      | 22 ++++++++++++++++++++++
 .github/workflows/cd-config.yml |  7 ++-----
 2 files changed, 24 insertions(+), 5 deletions(-)
 create mode 100644 .github/maven-settings.xml

diff --git a/.github/maven-settings.xml b/.github/maven-settings.xml
new file mode 100644
index 00000000000..4d1f107082c
--- /dev/null
+++ b/.github/maven-settings.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Maven settings for publishing to Sonatype Central from CI.
+
+  Maven 3.10+ binds server credentials to repository origins. The 'central' server id
+  defaults to https://repo.maven.apache.org, so the Sonatype origin must be declared
+  explicitly or the credentials are withheld and uploads fail with HTTP 401.
+-->
+<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 https://maven.apache.org/xsd/settings-1.2.0.xsd">
+  <servers>
+    <server>
+      <id>central</id>
+      <username>${env.MAVEN_REPO_USERNAME}</username>
+      <password>${env.MAVEN_REPO_TOKEN}</password>
+      <repositoryOrigins>
+        <repositoryOrigin>https://central.sonatype.com</repositoryOrigin>
+      </repositoryOrigins>
+    </server>
+  </servers>
+</settings>
diff --git a/.github/workflows/cd-config.yml b/.github/workflows/cd-config.yml
index f7358b14606..01870e0e8e9 100644
--- a/.github/workflows/cd-config.yml
+++ b/.github/workflows/cd-config.yml
@@ -39,18 +39,15 @@ jobs:
           distribution: 'temurin'
           java-version: 17
           cache: 'maven'
-          server-id: 'central'
-          server-username: MAVEN_REPO_USERNAME
-          server-password: MAVEN_REPO_TOKEN
+          overwrite-settings: false
           gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
-          gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Build the code with Maven
         run: mvn -B -ntp install -Pci
 
       - name: Deploy Artifacts
         if: ${{ github.actor != 'dependabot[bot]' }}
-        run: mvn deploy -P publish
+        run: mvn -B -s .github/maven-settings.xml deploy -P publish
         env:
           MAVEN_REPO_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
           MAVEN_REPO_TOKEN: ${{ secrets.SONATYPE_TOKEN }}