From a59f0685655e380ee59552635abd11483e7e94df Mon Sep 17 00:00:00 2001
From: Liam Hughes <liam.hughes@octopus.com>
Date: Wed, 14 Oct 2026 23:37:25 +0000
Subject: [PATCH] ci: Upgrade central-publishing-maven-plugin to 0.12.0 with
 skipUpload

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/actions/build-test-pack-deploy/action.yml | 14 +++++---------
 pom.xml                                           |  4 ++--
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/.github/actions/build-test-pack-deploy/action.yml b/.github/actions/build-test-pack-deploy/action.yml
index 222f238..01eaeb9 100644
--- a/.github/actions/build-test-pack-deploy/action.yml
+++ b/.github/actions/build-test-pack-deploy/action.yml
@@ -28,12 +28,6 @@ runs:
         gpg-private-key: ${{ inputs.gpg-private-key }}
         gpg-passphrase: MAVEN_GPG_PASSPHRASE # The name of the environment variable to use for GPG passphrase.
 
-        # server-id, server-username, and server-password need to be set to avoid errors from
-        # central-publishing-maven-plugin, even though the plugin is configured with skipPublishing=true
-        server-id: central
-        server-username: MAVEN_CENTRAL_USERNAME
-        server-password: MAVEN_CENTRAL_PASSWORD
-
     - name: Compute version
       id: version
       shell: bash
@@ -62,15 +56,13 @@ runs:
       shell: bash
       # One full Maven lifecycle run.
       #
-      # central-publishing-maven-plugin is configured with skipPublishing=true, so it assembles
+      # central-publishing-maven-plugin is configured with skipUpload=true, so it assembles
       # target/central-publishing/central-bundle.zip and generates checksums without uploading.
       #
       # GPG signing is skipped for fork PRs as forks don't receive repository secrets. These builds are not published to
       # Octopus, so signing is not required.
       env:
         MAVEN_GPG_PASSPHRASE: ${{ inputs.gpg-passphrase }}
-        MAVEN_CENTRAL_USERNAME: placeholder
-        MAVEN_CENTRAL_PASSWORD: placeholder
       run: mvn -B clean deploy ${{ github.event.pull_request.head.repo.fork == true && '-Dgpg.skip=true' || '' }}
 
     - name: Name the bundle
@@ -79,6 +71,10 @@ runs:
       run: |
         SRC="target/central-publishing/central-bundle.zip"
         [ -f "$SRC" ] || { echo "Error: bundle not found at $SRC"; exit 1; }
+        # Maven Central rejects bundles containing local-repository metadata.
+        if unzip -l "$SRC" | grep -E 'maven-metadata-local\.xml|_remote\.repositories'; then
+          echo "Error: bundle contains local-repository metadata files"; exit 1
+        fi
         DEST="octopus-openfeature-provider-java.${{ steps.version.outputs.version }}.zip"
         mv "$SRC" "$DEST"
         echo "path=$DEST" >> "$GITHUB_OUTPUT"
diff --git a/pom.xml b/pom.xml
index eae4ff0..0796213 100644
--- a/pom.xml
+++ b/pom.xml
@@ -55,11 +55,11 @@
             <plugin>
                 <groupId>org.sonatype.central</groupId>
                 <artifactId>central-publishing-maven-plugin</artifactId>
-                <version>0.8.0</version>
+                <version>0.12.0</version>
                 <extensions>true</extensions>
                 <configuration>
                     <publishingServerId>central</publishingServerId>
-                    <skipPublishing>true</skipPublishing> <!-- Octopus owns the upload to Maven Central. -->
+                    <skipUpload>true</skipUpload> <!-- Octopus owns the upload to Maven Central. -->
                 </configuration>
             </plugin>
             <plugin>