[rousso]

Since the merge of #73, the snapshot publication fails with HTTP 401 (run). The run log gives the reason:

Not using credentials of server 'central' for repository https://central.sonatype.com/repository/maven-snapshots/:
the origins declared for this id are [https://repo.maven.apache.org].

The GitHub runners now come with Maven 3.10, which sends the credentials of a server only to the hosts known for its id (documentation). For the id central, Maven only knows https://repo.maven.apache.org, so the snapshots are uploaded without credentials. The last successful publication, on 4 October, ran on an older runner image.

Change

The workflow now writes settings.xml itself, because actions/setup-java cannot declare repositoryOrigins. The server keeps the id central and the same secrets, and https://central.sonatype.com is declared as one of its origins. The protection that Maven added stays in place for every other host.

The release publication is not affected: the server id and credentials are unchanged, and the Central publishing plugin reads them by id.

Verification

The generated settings.xml is valid against the settings 1.3.0 schema. It can only be tested on GitHub: we can run the publish workflow manually on this branch before merging, which publishes the same code as develop.