Problem
release-on-tag.yml has failed on every run since its introduction (release/0.1.8, Sept 2025). The "Build and Deploy to Central" step dies with Unable to upload bundle for deployment: Invalid request. Status: 401 from the Sonatype Central publisher.
Root cause
actions/setup-java's server-username and server-password inputs take the names of environment variables that hold the credentials, not the credential values themselves. The workflow passes the secret values (server-username: ${{ secrets.CENTRAL_USERNAME }}), so the action looks for an environment variable literally named e.g. simbo1905, finds none, and writes an empty username/password into settings.xml for the central server. The Central publishing plugin then authenticates with empty credentials and gets 401.
Fix
Pass the env-var names (server-username: CENTRAL_USERNAME, server-password: CENTRAL_PASSWORD, gpg-passphrase: GPG_PASSPHRASE) and provide the values through the step's env: block. Past releases only reached Central through the documented manual local deploy; this fix makes the tag-driven release self-sufficient.
Why
The 2026.08.30 release should publish to Central automatically from the tag, as the release process documents.
Problem
release-on-tag.ymlhas failed on every run since its introduction (release/0.1.8, Sept 2025). The "Build and Deploy to Central" step dies withUnable to upload bundle for deployment: Invalid request. Status: 401from the Sonatype Central publisher.Root cause
actions/setup-java'sserver-usernameandserver-passwordinputs take the names of environment variables that hold the credentials, not the credential values themselves. The workflow passes the secret values (server-username: ${{ secrets.CENTRAL_USERNAME }}), so the action looks for an environment variable literally named e.g.simbo1905, finds none, and writes an empty username/password intosettings.xmlfor thecentralserver. The Central publishing plugin then authenticates with empty credentials and gets 401.Fix
Pass the env-var names (
server-username: CENTRAL_USERNAME,server-password: CENTRAL_PASSWORD,gpg-passphrase: GPG_PASSPHRASE) and provide the values through the step'senv:block. Past releases only reached Central through the documented manual local deploy; this fix makes the tag-driven release self-sufficient.Why
The 2026.08.30 release should publish to Central automatically from the tag, as the release process documents.