From 14a02110760c19277708ad7fba6024657ba1ae3e Mon Sep 17 00:00:00 2001
From: atishj99 <atish.jadhav@checkmarx.com>
Date: Thu, 15 Oct 2026 13:45:13 +0530
Subject: [PATCH] Pin Maven to 3.9.16 in release workflow

Add a step to the release GitHub Actions workflow that downloads and installs Apache Maven 3.9.16, verifies the SHA-512 checksum, extracts it to /opt and appends its bin to GITHUB_PATH. This pins Maven because Maven 3.10+ breaks central-publishing-maven-plugin bundling (upstream bug). The step is placed before the POM version update in the release job to ensure a compatible Maven is used during release tasks.
---
 .github/workflows/release.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4ec8ffe..ccd5b25 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -158,6 +158,16 @@ jobs:
         env:
           ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
 
+      - name: Pin Maven to 3.9.16
+        # Maven 3.10+ breaks central-publishing-maven-plugin bundling (upstream bug)
+        run: |
+          MAVEN_VERSION=3.9.16
+          curl -fsSL -o /tmp/maven.tar.gz "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          curl -fsSL -o /tmp/maven.tar.gz.sha512 "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz.sha512"
+          echo "$(cat /tmp/maven.tar.gz.sha512)  /tmp/maven.tar.gz" | sha512sum -c -
+          sudo tar -xzf /tmp/maven.tar.gz -C /opt
+          echo "/opt/apache-maven-${MAVEN_VERSION}/bin" >> $GITHUB_PATH
+
       - name: Update the POM version.
         run: mvn -B versions:set -DnewVersion="$RELEASE_VERSION" --file pom.xml -DskipTests