ci: #17 (github) Maven Central releases broken - OSSRH sunset migrati…

[tim-brown]

[This is also in ticket #17]

Closes #17

Context

I want to use RepeatableRandom and the instant providers in a project of mine, but Ocava is not currently being distributed through Maven Central - forcing me to build it locally. The latest available version on Maven Central is from before the OSSRH sunset.

I've asked Claude (LLM) to investigate why the release workflow is failing, and it has analysed the problem as follows.

---

Problem

The Maven Central release workflow has been failing since OSSRH (OSS Repository Hosting) was sunset on June 30, 2025. The most recent release attempt failed: https://github.com/ocadotechnology/Ocava/actions/runs/19820654038/job/56782041763

Sonatype shut down both oss.sonatype.org and s01.oss.sonatype.org as part of the OSSRH end-of-life. All publishing must now go through the new Central Portal.

---

LLM Analysis

Finding 1: Sonatype URL mismatch (pre-sunset)

Even before the sunset, there was an inconsistency in pom.xml:

• nexus-staging-maven-plugin was configured to use https://oss.sonatype.org/ (the old legacy URL)
• distributionManagement was configured to use https://s01.oss.sonatype.org/ (the newer URL)

This mismatch suggests a partial migration was attempted at some point but never completed.

Finding 2: OSSRH is dead

As of June 30, 2025, both URLs are now defunct. Sonatype has migrated all projects to the new Central Portal at https://central.sonatype.com.

The fix requires:

1. Updating all URLs to use the new OSSRH Staging API compatibility layer (https://ossrh-staging-api.central.sonatype.com/)
2. Generating new Central Publisher User Tokens (old OSSRH tokens return 401 Unauthorized)

Finding 3: Outdated GitHub Actions

In .github/workflows/maven-release.yml, the workflow uses actions/setup-java@v1 with a distribution parameter:

uses: actions/setup-java@v1
with:
  java-version: 17
  distribution: 'temurin'

The distribution parameter was only added in v2 of this action. With v1, this parameter is silently ignored, causing unpredictable JDK selection.

Finding 4: Dead Bintray repository causing confusing errors

The pom.xml contains a repository reference to Bintray:

<repositories>
    <repository>
        <id>bintray</id>
        <url>https://dl.bintray.com/cbeust/maven</url>
    </repository>
</repositories>

Bintray was shut down on May 1, 2021. This causes Maven to attempt resolution from a dead URL, producing confusing errors like:

Non-resolvable import POM: The following artifacts could not be resolved:
com.ocadotechnology:ocava-open-source-bom:pom:17.29.108 (absent):
Could not find artifact com.ocadotechnology:ocava-open-source-bom:pom:17.29.108
in bintray (https://dl.bintray.com/cbeust/maven)

This error is misleading - the BOM isn't on Bintray and never was, but Maven tries there anyway before failing.

References consulted

• OSSRH Sunset Announcement
• OSSRH Staging API Migration Guide

---

Solution

I've prepared a PR with the code changes:

• Remove dead Bintray repository reference
• Update actions/checkout and actions/setup-java to v4
• Update nexus-staging-maven-plugin URL to https://ossrh-staging-api.central.sonatype.com/
• Update distributionManagement URLs to the new endpoints

However, the maintainers will need to:

1. Log into https://central.sonatype.com with your existing OSSRH credentials
2. Generate new Central Publisher User Tokens (old OSSRH tokens no longer work)
3. Update the GitHub repository secrets (ossrh_login, ossrh_pass) with the new tokens

Happy to help further if needed.

[tim-brown]

Note on JDK version: The CI workflows were using JDK 17 but pom.xml specifies 21 and 21. This mismatch would cause compilation failures. I've updated both workflows to use JDK 21 to match the project's compiler settings. If JDK 17 compatibility is intended, please let me know and I can revert the JDK change - but the pom.xml would also need updating to 17.

[mvy]

Thanks, I'll make sure to include these as well. Sorry for the delay, it's taken me a while to track down access to maven central, and other work/life happened as well.

I'll endeavour to get these pushed soon.