From 5c42385573d93f45606d0a2804994bf3d137a6cc Mon Sep 17 00:00:00 2001
From: Alex Andres <andres.alex@protonmail.com>
Date: Sat, 10 Oct 2026 13:34:58 +0200
Subject: [PATCH] ci: send Central credentials again under Maven 3.10

The ubuntu-22.04 runner image moved to Maven 3.10.0, which only sends a
server's credentials to the origins of the repository with that id. Our
server id is "central", the id of Maven Central itself, so the token was
withheld from central.sonatype.com and the snapshot deploy failed with
HTTP 401. maven.repository.credentialScope=id restores id-only matching.
---
 .github/actions/publish/action.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/actions/publish/action.yml b/.github/actions/publish/action.yml
index 2182705c..146abb30 100644
--- a/.github/actions/publish/action.yml
+++ b/.github/actions/publish/action.yml
@@ -72,12 +72,19 @@ runs:
     # natives.dir makes webrtc and webrtc-java-media attach the jars of all
     # platforms instead of the host's. skipPublishing suppresses both the
     # bundling and the upload.
+    #
+    # Since Maven 3.10, credentials are only sent to the origins of the
+    # repository with the server's id. The server is "central", which is also
+    # the id of Maven Central itself (repo.maven.apache.org), so the token would
+    # be withheld from central.sonatype.com and every upload fails with 401.
+    # credentialScope=id restores matching by id alone.
     - name: Deploy
       env:
         PROFILES: ${{ inputs.profiles }}
         SKIP_PUBLISHING: ${{ inputs.skip-publishing }}
       run: >
         mvn -B deploy -pl .,webrtc,webrtc-java-media -DskipTests
+        -Dmaven.repository.credentialScope=id
         ${PROFILES:+-P$PROFILES}
         -Dnatives.dir="$PWD/natives"
         -DskipPublishing="$SKIP_PUBLISHING"