Nexus Maven Snapshots Migrations

[zelinh]

Coming from opensearch-project/opensearch-build#5551

Problem

Sonatype has announced the deprecation of the OSSRH (oss.sonatype.org) portal by the end of June 2025 (announcement). To maintain Maven Central publishing, we must migrate to the new Central Portal (central.sonatype.org) before that date.

We currently publish Maven Snapshots through GHA and each repo maintains its own workflow. You would need to update the publish and consume endpoint to the new Central Portal https://central.sonatype.com/repository/maven-snapshots/.
More info can be found at Sonatype website for SNAPSHOTS. https://central.sonatype.org/publish/publish-portal-snapshots/

The new snapshots artifacts can be browsed, observed and downloaded from https://central.sonatype.com/service/rest/repository/browse/maven-snapshots/
If your repo is using some script command to download artifacts, you may need to route with this relative path.

The workflow used to import Sonatype credentials with certain AWS role and retrieve secrets and export them as local environment variables as SONATYPE_USERNAME and SONATYPE_PASSWORD.
This process can now be switched to onepassword and load secrets like these

      - name: Load secret
        uses: 1password/load-secrets-action@v2
        with:
          # Export loaded secrets as environment variables
          export-env: true
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
          SONATYPE_USERNAME: op://opensearch-infra-secrets/maven-central-portal-credentials/username
          SONATYPE_PASSWORD: op://opensearch-infra-secrets/maven-central-portal-credentials/password