[rfecher]

The Eclipse Foundation has added publishing credentials for the org.locationtech namespace as repository secrets, declared in the LocationTech Otterdog config:

• a Central Portal user token: CENTRAL_SONATYPE_TOKEN_USERNAME / _PASSWORD;
• a signing key: GPG_PRIVATE_KEY, an armored export of the signing subkeys, plus GPG_PASSPHRASE_NEW and GPG_KEY_ID.

The Publish workflow still read the 2020-era SONATYPE_* and GPG_* secrets, which predate the Central Portal. This switches it to the new ones, following the CBI guide for publishing to the Central Portal from GitHub Actions.

• Portal token: goes into the central server entry of .utility/.maven.xml.
• Signing:
  • actions/setup-java imports the signing key (gpg-private-key, gpg-passphrase: MAVEN_GPG_PASSPHRASE).
  • maven-gpg-plugin 3.2.8 reads the passphrase from MAVEN_GPG_PASSPHRASE and signs with -Dgpg.keyname=$GPG_KEY_ID.
  • The base64 key and ownertrust import is gone, along with the settings profile that set gpg.executable from an unset GPG_EXECUTABLE.
• central-publishing-maven-plugin 0.11.0 has no waitUntilPublished parameter, so the root pom's and dev-resources' setting was silently ignored. <waitUntil>published</waitUntil> is the setting that waits for publication. Each deployment is now named after the version.
• Docs: the Maven artifacts appendix of the developer guide describes the new secrets.

Publishing stays gated exactly as before: on PUBLISH_ON_2X_JDK8, or a manual Run workflow. The same change for master is #1996. Once both are merged, nothing uses the old GPG_OWNERTRUST, GPG_PASSPHRASE, GPG_SECRET_KEYS, SONATYPE_USERNAME or SONATYPE_PASSWORD secrets, and they can be removed from the Otterdog config, as the Eclipse admins recommended.

Not exercised: the signing and upload themselves need the secrets, so they run only when publishing does. With -Prelease, help:effective-pom resolves the new plugin configuration.