Should we make this a property so that it can be overridden at the project level?

It seems that the problem with this is that you need a login for the groupId to be able to perform the publish. I'm guessing the EF is not going to give that out.

It would be good to keep it as a property, following default names in the plugin, so it could be transparently overridden without a need to disable the execution and write everything again. Not all projects are using the parent are from Eclipse Foundation, and external projects can use different strategies to publish.

The groupId can be changed in "children".

The token is per login, but groupId defines a namespace, login:namespace is m:n relation. User can have access to multiple namespaces, namespace can be managed by multiple users. I have no idea how many users can manage this parent and the org.eclipse.ee4j namespace, for example. We can ask on GitLab ...

To do the deploy you need a token, which is bit surprisingly a pair like this, copy pasted from the Maven Central website to settings.xml; it can be regenerated, so I guess somebody in Eclipse can create credentials for the CI which would be used for that, while committers would never see them.

    <server>
      <id>central</id>
      <username>ADXhkv</username>
      <password>LP3dK1fEgrhJyK7Gdhdaf79nCr8xtKxBa</password>
    </server>

Basically we could use something like this on Jenkins - however still somebody permitted has to create these credentials: https://stackoverflow.com/a/57463849/375449 .

Another option would be as you wrote, committers would be permitted to publish to a namespace, and then they would use tokens they generated to set build parameters on the CI. However then every project would have to ask to add these people to the namespace, and somebody authorized in Eclipse Foundation then would have to ask Maven Central for changes by email. (I had to do this process for OmniFish, for a company of the size of Eclipse it seems as a lot of work, but maybe it is not so bad).