From 26a4183b014d9f137491acfc5b7555f313406606 Mon Sep 17 00:00:00 2001
From: Simon Massey <322608+simbo1905@users.noreply.github.com>
Date: Sun, 30 Aug 2026 18:35:05 +0100
Subject: [PATCH] Issue #156 fix Central publish 401 in release workflow

actions/setup-java's server-username/server-password/gpg-passphrase
inputs take environment variable NAMES, not secret values. Passing the
values directly left settings.xml with empty credentials, so the
Sonatype Central upload failed with 401 on every release tag since
0.1.8. Provide the values via the step env block and reference the
names instead.
---
 .github/workflows/release-on-tag.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release-on-tag.yml b/.github/workflows/release-on-tag.yml
index e7d32b0e..f02e6fd1 100644
--- a/.github/workflows/release-on-tag.yml
+++ b/.github/workflows/release-on-tag.yml
@@ -30,10 +30,16 @@ jobs:
           java-version: '21'
           cache: maven
           server-id: central
-          server-username: ${{ secrets.CENTRAL_USERNAME }}
-          server-password: ${{ secrets.CENTRAL_PASSWORD }}
+          # setup-java expects ENVIRONMENT VARIABLE NAMES here, not values;
+          # the values are provided via the env block below (issue #156).
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_PASSWORD
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          gpg-passphrase: GPG_PASSPHRASE
+        env:
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Extract version from tag
         id: version