Switch from OSSRH to Sonatype Central Portal

Same as openzipkin/zipkin#3817

OSSRH (oss.sonatype.org) was shut down June 30, 2025. This replaces
nexus-staging-maven-plugin with central-publishing-maven-plugin and
updates all references accordingly.

Manual steps already completed:
 * Generated token at https://central.sonatype.com account settings
 * Updated SONATYPE_USER/SONATYPE_PASSWORD at
   https://github.com/organizations/openzipkin/settings/secrets/actions
 * Enabled SNAPSHOTs at
   https://central.sonatype.com/publishing/namespaces (io.zipkin)

Signed-off-by: Adrian Cole <adrian@tetrate.io>

Author: codefromthecrypt

.github/workflows/deploy.yml

@@ -49,8 +49,8 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           # SONATYPE_USER=<sonatype account token>
           # * deploys snapshots and releases to Sonatype
-          # * needs access to io.zipkin via OSSRH-16669
-          # * generate via https://oss.sonatype.org/#profile;User%20Token
+          # * needs access to io.zipkin namespace
+          # * generate token at https://central.sonatype.com
           # * referenced in .settings.xml
           SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
           # SONATYPE_PASSWORD=<password to sonatype account token>

.settings.xml

@@ -15,7 +15,7 @@
       <passphrase>${env.GPG_PASSPHRASE}</passphrase>
     </server>
     <server>
-      <id>ossrh</id>
+      <id>central</id>
       <username>${env.SONATYPE_USER}</username>
       <password>${env.SONATYPE_PASSWORD}</password>
     </server>

README.md

@@ -1,6 +1,6 @@
 [![Gitter chat](http://img.shields.io/badge/gitter-join%20chat%20%E2%86%92-brightgreen.svg)](https://gitter.im/openzipkin/zipkin)
 [![Build Status](https://travis-ci.org/openzipkin/zipkin-dependencies.svg?branch=master)](https://travis-ci.org/openzipkin/zipkin-dependencies)
-[![Maven Central](https://img.shields.io/maven-central/v/io.zipkin.dependencies/zipkin-dependencies.svg)](https://search.maven.org/search?q=g:io.zipkin.dependencies%20AND%20a:zipkin-dependencies)
+[![Maven Central](https://img.shields.io/maven-central/v/io.zipkin.dependencies/zipkin-dependencies.svg)](https://central.sonatype.com/search?q=zipkin-dependencies&namespace=io.zipkin.dependencies)
 
 # zipkin-dependencies
 
@@ -21,7 +21,7 @@ are supported, including Cassandra, MySQL and Elasticsearch.
 
 Until [SPARK-43831](https://issues.apache.org/jira/browse/SPARK-43831), Zipkin Dependencies requires Java 17 to run.
 
-The quickest way to get started is to fetch the [latest released job](https://search.maven.org/remote_content?g=io.zipkin.dependencies&a=zipkin-dependencies&v=LATEST) as a self-contained jar. For example:
+The quickest way to get started is to fetch the [latest released job](https://central.sonatype.com/search?q=zipkin-dependencies&namespace=io.zipkin.dependencies&sort=published) as a self-contained jar. For example:
 
 ```bash
 $ curl -sSL https://zipkin.io/quickstart.sh | bash -s io.zipkin.dependencies:zipkin-dependencies:LATEST zipkin-dependencies.jar
@@ -174,10 +174,10 @@ All artifacts publish to the group ID "io.zipkin.dependencies". We use a common
 release version for all components.
 
 ### Library Releases
-Releases are at [Maven Central](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22io.zipkin.dependencies%22)
+Releases are at [Maven Central](https://central.sonatype.com/search?q=zipkin-dependencies&namespace=io.zipkin.dependencies)
 
 ### Library Snapshots
-Snapshots are uploaded to [Sonatype](https://oss.sonatype.org/content/repositories/snapshots) after
+Snapshots are uploaded to [Sonatype](https://central.sonatype.com/repository/maven-snapshots/) after
 commits to master.
 
 ### Docker Images

RELEASE.md

@@ -24,7 +24,7 @@ This repo uses semantic versions. Please keep this in mind when choosing version
    which creates commits, `MAJOR.MINOR.PATCH` tag, and increments the version (maven-release-plugin).
 
    The `MAJOR.MINOR.PATCH` tag triggers [`build-bin/deploy`](build-bin/deploy), which does the following:
-     * Publishes jars to https://oss.sonatype.org/content/repositories/releases [`build-bin/maven/maven_deploy`](build-bin/maven/maven_deploy)
+     * Publishes jars to Sonatype [`build-bin/maven/maven_deploy`](build-bin/maven/maven_deploy)
        * Later, the same jars synchronize to Maven Central
      * Pushes images to Docker registries [`build-bin/docker_push`](build-bin/docker_push)
 
@@ -38,7 +38,7 @@ look at the notes in [.github/workflows/deploy.yml] and check the [org secrets](
 
 ### Troubleshooting invalid credentials
 
-If you receive a '401 unauthorized' failure from OSSRH, it is likely
+If you receive a '401 unauthorized' failure from Sonatype, it is likely
 `SONATYPE_USER` or `SONATYPE_PASSWORD` entries are invalid, or possibly the
 user associated with them does not have rights to upload.
 

build-bin/README.md

@@ -61,14 +61,19 @@ Actions includes the ability to skip documentation-only jobs.
 
 Here's a partial `test.yml` including only the aspects mentioned above.
 ```yaml
-on:
-  push:
-    tags: ''
-    branches: master
-    paths-ignore: '**/*.md'
-  pull_request:
-    branches: master
-    paths-ignore: '**/*.md'
+on:  # yamllint disable-line rule:truthy
+  push:  # non-tagged pushes to master
+    branches:
+      - master
+    tags-ignore:
+      - '*'
+    paths-ignore:
+      - '**/*.md'
+  pull_request:  # pull requests targeted at the master branch.
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
 
 jobs:
   test:
@@ -105,22 +110,26 @@ Here's a partial `deploy.yml` including only the aspects mentioned above. Notice
 explicitly defined and `on.tags` is a [glob pattern](https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet).
 
 ```yaml
-on:
+on:  # yamllint disable-line rule:truthy
   push:
-    tags: '[0-9]+.[0-9]+.[0-9]+**'  # e.g. 8.272.10 or 15.0.1_p9
-    branches: master
+    branches:
+      - master
+    # Don't deploy tags because the same commit for MAJOR.MINOR.PATCH is also
+    # on master: Redundant deployment of a release version will fail uploading.
+    tags-ignore:
+      - '*'
 
 jobs:
   deploy:
+    runs-on: ubuntu-24.04  # newest available distribution, aka noble
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
-      - name: Configure Deploy
-        run: build-bin/configure_deploy
+      - name: Deploy
         env:
           GH_USER: ${{ secrets.GH_USER }}
           GH_TOKEN: ${{ secrets.GH_TOKEN }}
-      - name: Deploy
-        # GITHUB_REF will be refs/heads/master or refs/tags/1.2.3
-        run: build-bin/deploy $(echo ${GITHUB_REF} | cut -d/ -f 3)
+        run: |  # GITHUB_REF = refs/heads/master or refs/tags/MAJOR.MINOR.PATCH
+          build-bin/configure_deploy &&
+          build-bin/deploy $(echo ${GITHUB_REF} | cut -d/ -f 3)
 ```

build-bin/maven/maven_unjar

@@ -68,12 +68,6 @@ if ! test -f ${artifact_id}.jar && [ ${is_release} = "true" ]; then
   echo "*** Resolving ${qualified_jar} from Maven default repositories..."
   ${mvn_get} || true
 
-  # Don't add load to Sonatype releases repository except when central sync is delayed
-  if ! test -f ${local_repo_path}; then
-    echo "*** Resolving ${qualified_jar} from Maven Sonatype releases repository..."
-    ${mvn_get} -DremoteRepositories=https://oss.sonatype.org/content/repositories/releases
-  fi
-
   cp ${local_repo_path} ${artifact_id}.jar
 fi
 

build-bin/mlc_config.json

@@ -1,8 +1,5 @@
 {
   "ignorePatterns": [
-    {
-      "pattern": "https://oss.sonatype.org/content/repositories/snapshots"
-    },
     {
       "pattern": "http://localhost:9411/zipkin/dependency"
     },

pom.xml

@@ -134,7 +134,7 @@
     <maven-shade-plugin.version>3.5.3</maven-shade-plugin.version>
     <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
     <maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>
-    <nexus-staging-maven-plugin.version>1.6.13</nexus-staging-maven-plugin.version>
+    <central-publishing-maven-plugin.version>0.10.0</central-publishing-maven-plugin.version>
   </properties>
 
   <name>Zipkin Dependencies (Parent)</name>
@@ -173,13 +173,9 @@
 
   <distributionManagement>
     <snapshotRepository>
-      <id>ossrh</id>
-      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+      <id>central</id>
+      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
     </snapshotRepository>
-    <repository>
-      <id>ossrh</id>
-      <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
-    </repository>
   </distributionManagement>
 
   <issueManagement>
@@ -381,9 +377,9 @@
         </plugin>
 
         <plugin>
-          <groupId>org.sonatype.plugins</groupId>
-          <artifactId>nexus-staging-maven-plugin</artifactId>
-          <version>${nexus-staging-maven-plugin.version}</version>
+          <groupId>org.sonatype.central</groupId>
+          <artifactId>central-publishing-maven-plugin</artifactId>
+          <version>${central-publishing-maven-plugin.version}</version>
         </plugin>
       </plugins>
     </pluginManagement>
@@ -614,16 +610,12 @@
       <build>
         <plugins>
           <plugin>
-            <groupId>org.sonatype.plugins</groupId>
-            <artifactId>nexus-staging-maven-plugin</artifactId>
+            <groupId>org.sonatype.central</groupId>
+            <artifactId>central-publishing-maven-plugin</artifactId>
             <extensions>true</extensions>
             <configuration>
-              <serverId>ossrh</serverId>
-              <nexusUrl>https://oss.sonatype.org/</nexusUrl>
-              <!-- Double the normal timeout even though we haven't had a problem in this project.
-                   The only outcome of timing out client side is trying again. -->
-              <stagingProgressTimeoutMinutes>10</stagingProgressTimeoutMinutes>
-              <autoReleaseAfterClose>true</autoReleaseAfterClose>
+              <publishingServerId>central</publishingServerId>
+              <autoPublish>true</autoPublish>
             </configuration>
           </plugin>