ci: Pin Maven to 3.9.16 with the Maven Wrapper

.github/actions/build-test-pack-deploy/action.yml

@@ -34,6 +34,13 @@ runs:
         server-username: MAVEN_CENTRAL_USERNAME
         server-password: MAVEN_CENTRAL_PASSWORD
 
+    # Build with the Maven version pinned in .mvn/wrapper/maven-wrapper.properties, not the runner image's.
+    # Under Maven 3.10, central-publishing-maven-plugin 0.8.0 adds local-repository files to the bundle, and Maven
+    # Central rejects it. See BMBB-1251.
+    - name: Show Maven version
+      shell: bash
+      run: ./mvnw -v
+
     - name: Compute version
       id: version
       shell: bash
@@ -56,7 +63,7 @@ runs:
       shell: bash
       # Must run before the deploy build: resource filtering bakes ${project.version} into
       # src/main/resources/project.properties during process-resources, so the version has to be set on disk first.
-      run: mvn -B versions:set -DnewVersion=${{ steps.version.outputs.version }} -DgenerateBackupPoms=false
+      run: ./mvnw -B versions:set -DnewVersion=${{ steps.version.outputs.version }} -DgenerateBackupPoms=false
 
     - name: Build, test, sign, and assemble bundle
       shell: bash
@@ -71,7 +78,7 @@ runs:
         MAVEN_GPG_PASSPHRASE: ${{ inputs.gpg-passphrase }}
         MAVEN_CENTRAL_USERNAME: placeholder
         MAVEN_CENTRAL_PASSWORD: placeholder
-      run: mvn -B clean deploy ${{ github.event.pull_request.head.repo.fork == true && '-Dgpg.skip=true' || '' }}
+      run: ./mvnw -B clean deploy ${{ github.event.pull_request.head.repo.fork == true && '-Dgpg.skip=true' || '' }}
 
     - name: Name the bundle
       id: bundle

.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,4 @@
+wrapperVersion=3.3.4
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce

CONTRIBUTING.md

@@ -38,20 +38,21 @@ git submodule update --init
 ### Prerequisites
 
 - JDK 11 or later. The provider targets Java 11, which is also what CI uses, so avoid APIs added after Java 11.
-- [Maven](https://maven.apache.org/) 3.x
 
 ### Commands
 
+Use the Maven Wrapper (`./mvnw`, or `mvnw.cmd` on Windows). It downloads the Maven version that CI uses, so you don't need Maven installed.
+
 ```bash
-mvn -B test
+./mvnw -B test
 ```
 
 The specification fixtures run as part of `SpecificationTests`.
 
 The build signs artifacts with GPG during the `verify` phase. If you run `verify`, `package`, or `install` locally without a GPG key set up, skip signing:
 
 ```bash
-mvn -B verify -Dgpg.skip=true
+./mvnw -B verify -Dgpg.skip=true
 ```
 
 ## Making a pull request