From a1ecf0dadebadbe5438ff6d9e3404041f3ed9084 Mon Sep 17 00:00:00 2001
From: Brendan Burns <5751682+brendandburns@users.noreply.github.com>
Date: Thu, 25 Jun 2026 16:47:35 +0000
Subject: [PATCH] chore: migrate Sonatype release to
 central-publishing-maven-plugin

---
 .github/workflows/release.yml  | 13 +++++--------
 .github/workflows/snapshot.yml | 10 +++++-----
 pom.xml                        | 22 ++++++++++++++++------
 3 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ad30faec47..f08017f2ce 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,9 +42,9 @@ jobs:
           distribution: 'temurin'
           java-version: 17.0.x
           cache: maven
-          server-id: ossrh
-          server-username: OSSRH_USERNAME
-          server-password: OSSRH_TOKEN
+          server-id: central
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_TOKEN
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: GPG_PASSPHRASE
       - name: Install Bazelisk
@@ -99,15 +99,12 @@ jobs:
       - name: Release Perform
         if: ${{ github.event.inputs.dry-run != 'true' }}
         env:
-          OSSRH_USERNAME: ${{ secrets.SNAPSHOT_UPLOAD_USER }}
-          OSSRH_TOKEN: ${{ secrets.SNAPSHOT_UPLOAD_PASSWORD }}
+          CENTRAL_USERNAME: ${{ secrets.SNAPSHOT_UPLOAD_USER }}
+          CENTRAL_TOKEN: ${{ secrets.SNAPSHOT_UPLOAD_PASSWORD }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSWORD }}
         run: |
           # The tests are already executed in the prepare, skipping
           ./mvnw -s /home/runner/.m2/settings.xml -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn -DlocalCheckout=true -Darguments=-DskipTests org.apache.maven.plugins:maven-release-plugin:perform
-          curl -X POST \
-            -H "Authorization: Bearer $(echo ${{ secrets.SNAPSHOT_UPLOAD_USER }}:${{ secrets.SNAPSHOT_UPLOAD_PASSWORD }} | base64 -w0)" \
-            https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/io.kubernetes -v
           git push https://${{ github.token }}@github.com/${{ github.repository }}.git \
             automated-release-${{ github.event.inputs.releaseVersion }}:automated-release-${{ github.event.inputs.releaseVersion }}
           git push https://${{ github.token }}@github.com/${{ github.repository }}.git v${{ github.event.inputs.releaseVersion }}
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 027fb4a78c..84e624b298 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -19,9 +19,9 @@ jobs:
           distribution: 'temurin'
           java-version: 17.0.x
           cache: maven
-          server-id: ossrh
-          server-username: OSSRH_USERNAME
-          server-password: OSSRH_TOKEN
+          server-id: central
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_TOKEN
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: GPG_PASSPHRASE
       - name: Assert Snapshot Version
@@ -35,6 +35,6 @@ jobs:
       - name: Publish to Apache Maven Central
         run: ./mvnw deploy
         env:
-          OSSRH_USERNAME: ${{ secrets.SNAPSHOT_UPLOAD_USER }}
-          OSSRH_TOKEN: ${{ secrets.SNAPSHOT_UPLOAD_PASSWORD }}
+          CENTRAL_USERNAME: ${{ secrets.SNAPSHOT_UPLOAD_USER }}
+          CENTRAL_TOKEN: ${{ secrets.SNAPSHOT_UPLOAD_PASSWORD }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSWORD }}
diff --git a/pom.xml b/pom.xml
index 7b019b43f7..775a34f147 100644
--- a/pom.xml
+++ b/pom.xml
@@ -491,15 +491,10 @@
 
   <distributionManagement>
     <snapshotRepository>
-      <id>ossrh</id>
+      <id>central</id>
       <url>https://central.sonatype.com/repository/maven-snapshots/</url>
       <layout>default</layout>
     </snapshotRepository>
-    <repository>
-      <id>ossrh</id>
-      <url>https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/</url>
-      <layout>default</layout>
-    </repository>
   </distributionManagement>
 
   <build>
@@ -589,6 +584,11 @@
           <artifactId>maven-enforcer-plugin</artifactId>
           <version>3.6.3</version>
         </plugin>
+        <plugin>
+          <groupId>org.sonatype.central</groupId>
+          <artifactId>central-publishing-maven-plugin</artifactId>
+          <version>0.10.0</version>
+        </plugin>
       </plugins>
     </pluginManagement>
     <plugins>
@@ -782,6 +782,16 @@ limitations under the License.
               </execution>
             </executions>
           </plugin>
+          <plugin>
+            <groupId>org.sonatype.central</groupId>
+            <artifactId>central-publishing-maven-plugin</artifactId>
+            <extensions>true</extensions>
+            <configuration>
+              <publishingServerId>central</publishingServerId>
+              <autoPublish>true</autoPublish>
+              <waitUntil>published</waitUntil>
+            </configuration>
+          </plugin>
           <plugin>
             <groupId>org.jacoco</groupId>
             <artifactId>jacoco-maven-plugin</artifactId>