From f2fa1e30871b0a93f9910f89a3427b7258fe892b Mon Sep 17 00:00:00 2001
From: Peter Zhu <zhujiaxi@amazon.com>
Date: Tue, 14 Oct 2025 13:38:37 -0400
Subject: [PATCH] [Backport 2.19] Onboarding new maven snapshots publishing to
 s3 (OpenSearch Core)

Signed-off-by: Peter Zhu <zhujiaxi@amazon.com>
---
 .github/workflows/publish-maven-snapshots.yml | 22 ++++++++++++-------
 CHANGELOG.md                                  |  1 +
 build.gradle                                  |  9 ++++----
 3 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/publish-maven-snapshots.yml b/.github/workflows/publish-maven-snapshots.yml
index a3c6a7557ed99..6b6158a354cdb 100644
--- a/.github/workflows/publish-maven-snapshots.yml
+++ b/.github/workflows/publish-maven-snapshots.yml
@@ -18,22 +18,28 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
+      - uses: actions/checkout@v5
+      - name: Set up JDK 21
+        uses: actions/setup-java@v5
         with:
-          distribution: adopt
-          java-version: 17
+          distribution: temurin
+          java-version: 21
 
       - name: Load secret
-        uses: 1password/load-secrets-action@v2
+        uses: 1password/load-secrets-action@v3
         with:
           # Export loaded secrets as environment variables
           export-env: true
         env:
           OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
-          SONATYPE_USERNAME: op://opensearch-infra-secrets/maven-central-portal-credentials/username
-          SONATYPE_PASSWORD: op://opensearch-infra-secrets/maven-central-portal-credentials/password
+          MAVEN_SNAPSHOTS_S3_REPO: op://opensearch-infra-secrets/maven-snapshots-s3/repo
+          MAVEN_SNAPSHOTS_S3_ROLE: op://opensearch-infra-secrets/maven-snapshots-s3/role
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v5
+        with:
+          role-to-assume: ${{ env.MAVEN_SNAPSHOTS_S3_ROLE }}
+          aws-region: us-east-1
 
       - name: Publish snapshots to maven
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6c4ca216412d..aaa592e151046 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,5 +43,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Change single shard assignment log message from warn to debug ([#18186](https://github.com/opensearch-project/OpenSearch/pull/18186))
 - Replace centos:8 with almalinux:8 since centos docker images are deprecated ([#19154](https://github.com/opensearch-project/OpenSearch/pull/19154))
 - Allow plugins to copy folders into their config dir during installation ([#19343](https://github.com/opensearch-project/OpenSearch/pull/19343))
+- Onboarding new maven snapshots publishing to s3 ([#19632](https://github.com/opensearch-project/OpenSearch/pull/19632))
 
 [Unreleased 2.19.x]: https://github.com/opensearch-project/OpenSearch/compare/fd9a9d90df25bea1af2c6a85039692e815b894f5...2.19
diff --git a/build.gradle b/build.gradle
index 3f0602d4392ba..1a646f08034f9 100644
--- a/build.gradle
+++ b/build.gradle
@@ -125,10 +125,11 @@ subprojects {
         }
         maven {
           name = 'Snapshots'
-          url = 'https://central.sonatype.com/repository/maven-snapshots/'
-          credentials {
-            username = "$System.env.SONATYPE_USERNAME"
-            password = "$System.env.SONATYPE_PASSWORD"
+          url = System.getenv("MAVEN_SNAPSHOTS_S3_REPO")
+          credentials(AwsCredentials) {
+            accessKey = System.getenv("AWS_ACCESS_KEY_ID")
+            secretKey = System.getenv("AWS_SECRET_ACCESS_KEY")
+            sessionToken = System.getenv("AWS_SESSION_TOKEN")
           }
         }
       }