Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically creating a server called github can cause surprising errors #51

Closed
jcansdale opened this issue Mar 16, 2020 · 6 comments · May be fixed by affiliatedkat/setup-java#2
Closed

Comments

@jcansdale
Copy link

I was setting up a Maven workflow. Everything worked fine locally and I was able to publish using mvn deploy -D token=TOKEN. When I added the actions/setup-java@v1 action, things mysteriously started to fail.

It turned out it would work as long as my repository wasn't called github. You can see the workflow fails when I rename the repository/server from foobarbaz to github:
https://github.com/actions-packages-examples/maven-example/commit/b529abbd86131a0da8feb1a3404be5d93d4a63f3

If I user needs to consume any packages, they will need to create a server configuration for every repository they're consuming packages from. Having a server called github implicitly defined is likely to get in the way and cause confusion.

Could we make it so that that server-id needs to be explicitly set and isn't automatically created?

@joschi
Copy link
Contributor

joschi commented May 24, 2020

You can already override the Maven server ID with the action's server-id input and the ID github will be used by default:

const id = core.getInput('server-id', {required: false}) || undefined;

export const DEFAULT_ID = 'github';

My unscientific guess is, that this is the behavior helping the majority of all users and shouldn't be changed in order to avoid friction for the majority's use case.

https://github.com/actions/setup-java#publishing-using-apache-maven

@jcansdale
Copy link
Author

@joschi,

My unscientific guess is, that this is the behavior helping the majority of all users and shouldn't be changed in order to avoid friction for the majority's use case.

What I don't understand it how a user would know that the following action will create a server called github with blank credentials?

- uses: actions/setup-java@v1
    with:
        java-version: 1.8

I assumed this action would simply setup Java 1.8.

Using a default server name if credentials are specified would be one thing, but creating a default server with blank credentials when no server or credentials are specified seems surprising! 😕

To put it another way, I don't understand how creating a creating a default server with blank credentials would help anyone. They won't be able to publish or consume packages using this server.

@joschi
Copy link
Contributor

joschi commented May 24, 2020

@jcansdale As far as I understand the code, the github server in the Maven configuration wouldn't be empty, but use GITHUB_ACTOR and GITHUB_TOKEN as credentials:

setup-java/src/auth.ts

Lines 44 to 60 in b74d5a6

export function generate(
id = DEFAULT_ID,
username = DEFAULT_USERNAME,
password = DEFAULT_PASSWORD
) {
return `
<settings>
<servers>
<server>
<id>${escapeXML(id)}</id>
<username>\${env.${escapeXML(username)}}</username>
<password>\${env.${escapeXML(password)}}</password>
</server>
</servers>
</settings>
`;
}

The setup-java action also mentions that it's setting this up:

creating settings.xml with server-id: github; environment variables: username=$GITHUB_ACTOR, password=$GITHUB_TOKEN, and gpg-passphrase=null

https://github.com/actions/setup-java/runs/701460926?check_suite_focus=true#step:5:15

To put it another way, I don't understand how creating a creating a default server with blank credentials would help anyone.

Since it's using credentials for the GitHub repository the setup-java action is running in, you could use to it deploy artifacts in the local GitHub package repository:

https://help.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-apache-maven-for-use-with-github-packages#authenticating-with-the-github_token

@jcansdale
Copy link
Author

@joschi ,

As far as I understand the code, the github server in the Maven configuration wouldn't be empty, but use GITHUB_ACTOR and GITHUB_TOKEN as credentials:

I wonder if this is working as intended?

Here I change my server id to github, in the hope of using the automatic configuration:
https://github.com/actions-packages-examples/maven-example/pull/7

You can see this fails with:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy (default-deploy) on project my-app: Failed to retrieve remote metadata com.mycompany.app:my-app:1.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata com.mycompany.app:my-app:1.0-SNAPSHOT/maven-metadata.xml from/to github (https://maven.pkg.github.com/actions-packages-examples/maven-example): Authentication failed for https://maven.pkg.github.com/actions-packages-examples/maven-example/com/mycompany/app/my-app/1.0-SNAPSHOT/maven-metadata.xml 401 Unauthorized -> [Help 1]

https://github.com/actions-packages-examples/maven-example/pull/7/checks?check_run_id=707268001#step:5:487

Any idea what I'm doing wrong? 🤔

@Marcono1234
Copy link
Contributor

Related to #60

@maxim-lobanov
Copy link
Contributor

Automatic creation of settings.xml with github server is intentional and intended for GitHub Package Registry. The necessity of enabling this functionality by default was discussed in #79
Also this issue contains way to disable it if needs.
I will close this issue as duplicate

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants