ci(maven): pin Maven 3.9 and skip an existing GitHub Packages upload

.github/workflows/maven.yml

@@ -32,8 +32,11 @@ jobs:
           java-version: 21
           cache: maven
 
+      # jni/mvnw pins Maven 3.9. Maven 3.10 stages a maven-metadata-local.xml
+      # that central-publishing-maven-plugin 0.11.0 does not remove, and Central
+      # rejects the bundle: "Bundle has content that does NOT have a .pom file".
       - name: build
-        run: mvn --batch-mode --no-transfer-progress --file jni/pom.xml verify
+        run: jni/mvnw --batch-mode --no-transfer-progress --file jni/pom.xml verify
 
   # Split out so the secrets sit behind an environment and are never in reach of
   # a plain push build.
@@ -66,8 +69,17 @@ jobs:
             echo "REVISION=${INPUT_VERSION}" >> "$GITHUB_ENV"
           fi
 
+      # GitHub Packages refuses a second upload of a version with 409, so a rerun
+      # after a failed Maven Central step must not upload again. The jar goes up
+      # after the pom, so its presence means the upload completed.
       - name: publish to github packages
-        run: mvn --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Drevision="${REVISION}"
+        run: |
+          if curl --silent --fail --output /dev/null --user "x:${GITHUB_TOKEN}" \
+            "https://maven.pkg.github.com/${GITHUB_REPOSITORY}/app/opendocument/odr-core-java/${REVISION}/odr-core-java-${REVISION}.jar"; then
+            echo "odr-core-java ${REVISION} is already on GitHub Packages"
+            exit 0
+          fi
+          jni/mvnw --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Drevision="${REVISION}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -87,7 +99,7 @@ jobs:
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: publish to maven central
-        run: mvn --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Pcentral -Drevision="${REVISION}"
+        run: jni/mvnw --batch-mode --no-transfer-progress --file jni/pom.xml deploy -Pcentral -Drevision="${REVISION}"
         env:
           MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
           MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}

jni/.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,4 @@
+wrapperVersion=3.3.4
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce

jni/AGENTS.md

@@ -9,7 +9,7 @@ bindings (`python/`).
 | Path | What |
 |------|------|
 | `CMakeLists.txt` | Builds `libodr_jni` and `odr-core-java.jar`. Included from the root build via `ODR_JNI`, or standalone against an installed `odrcore`. `ODR_JNI_JAR=OFF` builds the native half alone, which is what `../android` does and the only build that needs no JDK. |
-| `pom.xml` | Maven distribution of the Java classes (`app.opendocument:odr-core-java`). `.github/workflows/maven.yml` publishes it to Maven Central (profile `central`) and GitHub Packages (profile `github`) on release. Keep `--release` and `-Xlint` in sync with `CMAKE_JAVA_COMPILE_FLAGS`. |
+| `pom.xml` | Maven distribution of the Java classes (`app.opendocument:odr-core-java`). `.github/workflows/maven.yml` publishes it to Maven Central (profile `central`) and GitHub Packages (profile `github`) on release. Run it through `mvnw`, which pins the Maven version that Central's publishing plugin works with. Keep `--release` and `-Xlint` in sync with `CMAKE_JAVA_COMPILE_FLAGS`. |
 | `src/` | One `jni_*` unit per public-API area. `odr_jni.hpp` (strings, exceptions, handles) and `jni_convert.hpp` (struct and POJO marshalling) are the helpers. |
 | `java/app/opendocument/core/` | The Java API: enums, POJOs (styles, metas, `HtmlConfig`), and handle-backed wrappers that extend `NativeResource`. `../android` compiles the same sources into the AAR. It stays java, because `add_jar` has no kotlin toolchain. |
 | `tests/` | JUnit 5 suite, run through ctest (`odr_jni_junit`). Inputs come from `TestFiles`. |

jni/README.md

@@ -48,11 +48,11 @@ dependencies {
 Prefer Central. GitHub Packages needs a token with `read:packages` even for a
 public package.
 
-Local build: `mvn --file jni/pom.xml verify` produces the jar plus the sources
-and javadoc jars in `jni/target/`. The `central` profile (`mvn deploy
--Pcentral`) adds the PGP signatures and the `developers` POM entry that Central
-requires. It is off the default build, so neither a signing key nor a portal
-token is needed to build or to deploy to GitHub Packages.
+Local build: `jni/mvnw --file jni/pom.xml verify` produces the jar plus the
+sources and javadoc jars in `jni/target/`. The `central` profile (`jni/mvnw
+deploy -Pcentral`) adds the PGP signatures and the `developers` POM entry that
+Central requires. It is off the default build, so neither a signing key nor a
+portal token is needed to build or to deploy to GitHub Packages.
 
 ## Building