update ossrh endpoints #106
Conversation
WalkthroughThe GitHub Actions workflow for Maven deployment has been updated to use new repository URLs for publishing to Apache Maven Central. The endpoints for both release and snapshot deployments now reference the ossrh-staging-api.central.sonatype.com domain instead of the previous oss.sonatype.org domain. Changes
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
33-37: Update GitHub Action versions to the maintained v3 releases
actions/checkout@v2andactions/setup-java@v1are no longer receiving security updates.
Switching to@v3gives SHA-256 signature verification, provenance attestations and performance improvements.- - uses: actions/checkout@v2 + - uses: actions/checkout@v3 ... - - name: Set up Maven Central Repository - uses: actions/setup-java@v1 + - name: Set up Maven Central Repository + uses: actions/setup-java@v3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/release.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build (8)
.github/workflows/release.yml
Outdated
| gpg-passphrase: MAVEN_GPG_PASSPHRASE | ||
| - name: Publish to Apache Maven Central | ||
| run: mvn clean deploy -DskipTests=true -Prelease "-Dreleases.repo=https://oss.sonatype.org/service/local/staging/deploy/maven2" "-Dsnapshots.repo=https://oss.sonatype.org/content/repositories/snapshots" | ||
| run: mvn clean deploy -DskipTests=true -Prelease "-Dreleases.repo=https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2" "-Dsnapshots.repo=https://ossrh-staging-api.central.sonatype.com/content/repositories/snapshots" |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Validate the new repository endpoints before merging
Sonatype’s migration guide points to the s01.oss.sonatype.org host for both staging and snapshot uploads.
The URLs used here (ossrh-staging-api.central.sonatype.com) appear to be the REST portal endpoints, not the Maven‐deploy endpoints. A mismatch will cause mvn deploy to fail with 404/401 errors once the workflow runs.
🌐 Web query:
What is the correct Maven deploy URL recommended by Sonatype after oss.sonatype.org shutdown?
💡 Result:
After the shutdown of oss.sonatype.org and the sunset of the legacy OSSRH service on June 30th, 2025, Sonatype recommends using the new Central Publisher Portal and API for Maven Central deployments. The correct and recommended deploy URL for publishing to Maven Central is:
https://central.sonatype.com/api/v1/publisher
This is now the official endpoint for deploying release artifacts using modern publishing tools such as JReleaser and is part of the new publishing workflow. Your Maven (or Gradle, or publishing tool) configuration should use this URL in place of the older endpoints[1].
If you still need to use the old Maven Nexus workflows (and are already registered for legacy access), the last supported deploy URLs were:
- For releases:
https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/ - For snapshots:
https://s01.oss.sonatype.org/content/repositories/snapshots/
However, these will be (or have been) sunset for most users in favor of the Central Publisher Portal and API[7][9][10].
Summary Table
| Use Case | Recommended URL |
|---|---|
| New standard deploy | https://central.sonatype.com/api/v1/publisher |
| (Legacy) releases | https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/ |
| (Legacy) snapshots | https://s01.oss.sonatype.org/content/repositories/snapshots/ |
Important Notes:
- You must also use token-based authentication instead of username/password going forward[5][7].
- New projects and namespaces should be registered via central.sonatype.com, not the old JIRA/OSSRH system[1][5][8].
- Always consult the official Sonatype documentation for the latest requirements and workflow changes.
Recommendation:
Update your build tooling to target https://central.sonatype.com/api/v1/publisher and migrate to token-based authentication to comply with the new Maven Central publishing workflow[1].
Citations:
- 1: https://blog.jora.dev/en/posts/publish-to-maven-central-with-gradle-in-2025
- 2: https://central.sonatype.org/news/20210223_new-users-on-s01/
- 3: https://blog.jakubholy.net/2010/02/07/releasing-a-project-to-maven-centr/
- 4: https://help.sonatype.com/en/nexus-repository-maven-plugin.html
- 5: https://central.sonatype.org/news/20240109_issues_sonatype_org_deprecation/
- 6: https://central.sonatype.org/publish/requirements/
- 7: https://central.sonatype.org/publish/publish-maven/
- 8: https://central.sonatype.org/faq/what-happened-to-issues-sonatype-org/
- 9: https://central.sonatype.org/publish/publish-guide/
- 10: https://central.sonatype.org/publish/release/
Update Maven Central publish endpoint and migrate to token-based auth
Maven Central has transitioned to the new Central Publisher API for release deployments. Replace the deprecated ossrh-staging-api.central.sonatype.com URLs with the official endpoint and switch to token authentication.
• File: .github/workflows/release.yml
• Location: the run: mvn clean deploy … step
Suggested diff:
- run: mvn clean deploy -DskipTests=true -Prelease \
- "-Dreleases.repo=https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2" \
- "-Dsnapshots.repo=https://ossrh-staging-api.central.sonatype.com/content/repositories/snapshots"
+ run: mvn clean deploy -DskipTests=true -Prelease \
+ "-Dreleases.repo=https://central.sonatype.com/api/v1/publisher" \
+ "-Dsnapshots.repo=https://s01.oss.sonatype.org/content/repositories/snapshots/" \
+ -DsonatypeToken=${{ secrets.SONATYPE_TOKEN }}Action items:
- Replace the release URL with https://central.sonatype.com/api/v1/publisher
- Point snapshots at https://s01.oss.sonatype.org/content/repositories/snapshots/ (if you still publish snapshots)
- Add a Sonatype token in secrets.SONATYPE_TOKEN and pass it via
-DsonatypeToken
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| run: mvn clean deploy -DskipTests=true -Prelease "-Dreleases.repo=https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2" "-Dsnapshots.repo=https://ossrh-staging-api.central.sonatype.com/content/repositories/snapshots" | |
| run: mvn clean deploy -DskipTests=true -Prelease \ | |
| "-Dreleases.repo=https://central.sonatype.com/api/v1/publisher" \ | |
| "-Dsnapshots.repo=https://s01.oss.sonatype.org/content/repositories/snapshots/" \ | |
| -DsonatypeToken=${{ secrets.SONATYPE_TOKEN }} |
🤖 Prompt for AI Agents
In .github/workflows/release.yml at line 44, update the Maven deploy command to
use the new Central Publisher API endpoint by replacing the release URL with
https://central.sonatype.com/api/v1/publisher and update the snapshots URL to
https://s01.oss.sonatype.org/content/repositories/snapshots/ if snapshots are
published. Additionally, add the Sonatype token from secrets.SONATYPE_TOKEN and
pass it to Maven using the -DsonatypeToken property to enable token-based
authentication.
1 participant
What's the purpose of this PR
As OSSRH has been shut down, we need to migrate to Central Publisher Portal. See https://central.sonatype.org/pages/ossrh-eol/
Follow this checklist to help us incorporate your contribution quickly and easily:
mvn clean testto make sure this pull request doesn't break anything.CHANGESlog.Summary by CodeRabbit