chore(deps): update dependency org.sonatype.central:central-publishing-maven-plugin to v0.11.0 - autoclosed

[team-github-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
org.sonatype.central:central-publishing-maven-plugin (source)	0.8.0 → 0.11.0

---

Configuration

📅 Schedule: (in timezone Australia/Brisbane)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[liamhughes]

🤖

Why CI is failing on this bump

central-publishing-maven-plugin changed the semantics of skipPublishing between 0.8.0 and 0.11.0. In 0.8.0, skipPublishing=true skipped only the upload, so staging + bundling still ran and produced target/central-publishing/central-bundle.zip. In 0.11.0, the plugin filters artifacts out before staging when skipPublishing=true, so nothing gets staged, no bundle is written, and our composite action's "Name the bundle" step fails with bundle not found → exit 1. Confirmed by disassembling both plugin versions and reproducing locally; there is no config in 0.11.0 that assembles the bundle without also uploading it (bundle-creation and upload are now welded into the same step).

Options to proceed

• Pin at 0.8.0 (recommended, low-effort): close this PR and add a Renovate ignore/allowedVersions rule so 0.9–0.11 stop being proposed. Keeps the current "Octopus owns the upload" workflow working as-is.
• Rebuild the bundle without the plugin (future-proof, more work): the bundle is just a zipped standard Maven repo layout (pom + jars + .md5/.sha1/.sha256/.sha512 + .asc). Produce it via mvn deploy to a local file:// repo (-DaltDeploymentRepository) plus the existing gpg/checksum plugins, then zip it — drops central-publishing-maven-plugin from CI entirely while Octopus still owns the upload.
• Not viable: any skipPublishing=false variant (incl. autoPublish=false) builds the bundle and uploads it to Central in the same step, which defeats the point.

[liamhughes]

This PR can't merge as-is. The CI build fails because 0.11.0 doesn't create the bundle that Octopus pushes to Maven Central.

pom.xml sets <skipPublishing>true</skipPublishing> because Octopus owns the upload. On 0.8.0, that skips only the upload, and the plugin still builds target/central-publishing/central-bundle.zip. On 0.11.0, it skips staging too, so no zip is produced:

[INFO] Skipping Central Release Publishing for artifact 'octopus-openfeature-provider' at user's request.
[INFO] No files to stage for artifact
...
Error: bundle not found at target/central-publishing/central-bundle.zip

Job log. That run used Maven 3.9.16, so this failure is separate from the Maven 3.10 bundle problem that #82 works around.

To take this upgrade, the build needs either a newer-plugin setting that builds the bundle without uploading, or a separate step that zips the staged files. Once it builds, check the zip with unzip -l under Maven 3.10 for maven-metadata-local.xml and _remote.repositories. If they're gone, the Maven pin from #82 can be removed.

Tracked in BMBB-1251.