Maven Central release fails under Maven 3.10: bundle has content without a .pom #325

Problem

The Release Maven workflow can no longer publish to Maven Central. The 3.2.1 release run 38121296549 built and tested every module, then Central rejected the deployment:

Deployment 06c4acea-ee1b-4ad3-bcba-f16d17430877 failed
 - Bundle has content that does NOT have a .pom file: org/openidentityplatform/commons/json-ref/core, ...

Cause

The ubuntu-24.04 runner image 20261004 replaced the system Maven 3.9.x with 3.10.0. Under Maven 3.10, central-publishing-maven-plugin leaves local-repository files in its staging directory, and they end up in central-bundle.zip:

• maven-metadata-local.xml in every artifact directory
• _remote.repositories (+ checksums) in every version directory

Reproduced locally with plugin 0.8.0 and 0.11.0 (the latest). Under Maven 3.9.16 the bundle is clean.

Workaround

#324 pins Maven 3.9.16 in release.yml and bumps the plugin to 0.11.0. This is a workaround, not a fix, so this issue stays open.

Upstream

• [3.10.0] LegacyLocalRepositoryManager.overlay() now writes Resolver local-repository files into the target repository (breaks central-publishing-maven-plugin) apache/maven#13388: in Maven 3.10.0, LegacyLocalRepositoryManager.overlay() writes Resolver local-repository files into the target repository. The Maven maintainers consider it a plugin issue.
• Maven 3.10.0: maven-metadata-local.xml is not removed before bundling → deployment rejected: "Bundle has content that does NOT have a .pom file" mavenplugins/central-publishing-maven-plugin#79 and Bump testng from 6.0.1 to 7.7.0 in /i18n-framework #78: the same bug, reported against the community fork. Bump testng from 6.9.8 to 7.7.0 in /commons/launcher #79 confirms that org.sonatype.central 0.8.0 and 0.11.0 behave the same way.
• fix: remove local repository files from the bundle for Maven 3.10 mavenplugins/central-publishing-maven-plugin#80: proposed fix in the fork (delete maven-metadata-local.xml, _remote.repositories and .locks before bundling). Not merged yet.
• The official Sonatype plugin has no public issue tracker. A report goes to central-support@sonatype.com or the Sonatype community forum.

Still to do

• Re-run Release Maven for 3.2.1 once [#325] Fix Maven Central release: pin Maven 3.9.16, bump central-publishing to 0.11.0 #324 is merged.
• Report the Maven 3.10 staging problem to central-publishing-maven-plugin (Sonatype).
• Remove the Maven 3.9.16 pin from release.yml once a plugin release handles Maven 3.10.
• Check whether snapshot publishing in deploy.yml, which still runs on the runner's Maven 3.10, is affected.