Migrate Maven Central publishing from OSSRH to Central Portal

Replace the deprecated nexus-staging-maven-plugin with
central-publishing-maven-plugin 0.9.0. Update GitHub Actions
(checkout v4, setup-java v4) and bump JDK to 11 in the deploy
workflow. Bump maven-gpg-plugin, maven-source-plugin, and
maven-javadoc-plugin to current versions. Pin all public GitHub
Actions to commit SHAs in both CI and deploy workflows.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: AaronAtDuo

.github/workflows/java-ci.yml

@@ -17,9 +17,9 @@ jobs:
         java: [8, 11, 17]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Setup java
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
           distribution: "zulu"
           java-version: ${{ matrix.java }}

.github/workflows/maven-deploy.yml

@@ -7,12 +7,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-    - name: Set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: Set up JDK 11
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'temurin'
 
     - name: Build with Maven
       run: mvn -B package
@@ -24,16 +25,17 @@ jobs:
       uses: duosecurity/duo_client_python/.github/actions/sbom-convert@master
 
     - name: Archive SBOM artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: duo_client_java_sbom
         path: spdx.json
 
     - name: Set up Apache Maven Central
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
-        java-version: 1.8
-        server-id: ossrh
+        java-version: '11'
+        distribution: 'temurin'
+        server-id: central
         server-username: MAVEN_USERNAME # env variable for username in deploy
         server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
         gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import

duo-client/pom.xml

@@ -148,23 +148,21 @@
       <id>release</id>
       <build>
         <plugins>
-          <!-- This is used to release our package to OSSHR and Maven -->
+          <!-- This is used to release our package to Maven Central via the Central Portal -->
           <plugin>
-            <groupId>org.sonatype.plugins</groupId>
-            <artifactId>nexus-staging-maven-plugin</artifactId>
-            <version>1.6.8</version>
+            <groupId>org.sonatype.central</groupId>
+            <artifactId>central-publishing-maven-plugin</artifactId>
+            <version>0.9.0</version>
             <extensions>true</extensions>
             <configuration>
-              <serverId>ossrh</serverId>
-              <nexusUrl>https://oss.sonatype.org/</nexusUrl>
-              <autoReleaseAfterClose>false</autoReleaseAfterClose>
+              <publishingServerId>central</publishingServerId>
             </configuration>
           </plugin>
           <!-- This plugin is used to sign our package with our GPG keys -->
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>
-            <version>1.5</version>
+            <version>3.2.7</version>
             <executions>
               <execution>
                 <id>sign-artifacts</id>
@@ -185,7 +183,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-source-plugin</artifactId>
-            <version>2.2.1</version>
+            <version>3.3.1</version>
             <executions>
               <execution>
                 <id>attach-sources</id>
@@ -199,7 +197,7 @@
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-javadoc-plugin</artifactId>
-            <version>2.9.1</version>
+            <version>3.11.2</version>
             <executions>
               <execution>
                 <id>attach-javadocs</id>