From c3b390a03f90db660165580560651e03e1b43f28 Mon Sep 17 00:00:00 2001 From: Hendrik Ebbers Date: Fri, 25 Sep 2026 07:50:16 +0200 Subject: [PATCH 1/2] fix(build): declare in the SCIM module POM spring-services-scim was the only module without an explicit . Maven then derives it from the parent as parent.url + "/" + artifactId, and PomChecker rejects that derived value, which made JReleaser abort the 1.4.0 release in the "Verifying POMs" stage before any upload. Co-Authored-By: Claude Opus 5 (1M context) --- spring-services-scim/pom.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/spring-services-scim/pom.xml b/spring-services-scim/pom.xml index 306b17b..52dbb9a 100644 --- a/spring-services-scim/pom.xml +++ b/spring-services-scim/pom.xml @@ -12,6 +12,7 @@ Spring Services SCIM Optional SCIM 2.0 Users service-provider feature module for spring-services + https://github.com/OpenElementsLabs/spring-services From cc46a869c3071358fd0769052a4453a1011cec43 Mon Sep 17 00:00:00 2001 From: Hendrik Ebbers Date: Fri, 25 Sep 2026 08:04:37 +0200 Subject: [PATCH 2/2] ci: gate PRs on the Maven Central POM rules Runs PomChecker's check-maven-central on every PR with the same settings JReleaser applies during the release, so a POM that Maven Central would reject fails in CI instead of after the release tag is pushed. fail.on.warning is what makes it bite: PomChecker reports a value derived from the parent (the missing that broke 1.4.0) as a warning, and JReleaser treats those as fatal. The release check is disabled because main carries a -SNAPSHOT version; the release workflow verifies the version against the tag instead. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4e6b23c..ad4e83a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,6 +19,20 @@ jobs: path: ~/.m2/repository key: maven-${{ hashFiles('pom.xml') }} restore-keys: maven- + - name: Check POMs against the Maven Central rules + # Same PomChecker rules JReleaser applies during the release, run on every + # PR so a POM that Maven Central would reject fails here instead of after + # the tag is already pushed. A module missing broke the 1.4.0 release + # exactly this way: Maven silently derives the value from the parent, and + # PomChecker rejects the derived one. + # + # fail.on.warning is what makes the check bite — PomChecker reports the + # derived-value cases as warnings, and JReleaser treats them as fatal. + # release=false skips the "no -SNAPSHOT" rule, which main must violate; + # the release workflow verifies the version against the tag instead. + run: > + ./mvnw -B org.kordamp.maven:pomchecker-maven-plugin:1.14.0:check-maven-central + -Dchecker.release=false -Dchecker.fail.on.warning=true - name: Build and test # -Pfull-build is the release-equivalent build: besides tests it generates # the Javadoc jar, sources jar and CycloneDX SBOM, so CI catches Javadoc/