Automatically creating a server called github can cause surprising errors #51

Activity

1. joschi commented on May 24, 2020

   

   joschi

   on May 24, 2020

   Contributor

   More actions

   You can already override the Maven server ID with the action's server-id input and the ID github will be used by default:

   setup-java/src/setup-java.ts

   Line 21 in b74d5a6

   const id = core.getInput('server-id', {required: false}) || undefined;

   
   

   setup-java/src/auth.ts

   Line 10 in b74d5a6

   export const DEFAULT_ID = 'github';

   My unscientific guess is, that this is the behavior helping the majority of all users and shouldn't be changed in order to avoid friction for the majority's use case.

   https://github.com/actions/setup-java#publishing-using-apache-maven
2. jcansdale commented on May 24, 2020

   

   jcansdale

   on May 24, 2020

   Author

   More actions

   @joschi,

   My unscientific guess is, that this is the behavior helping the majority of all users and shouldn't be changed in order to avoid friction for the majority's use case.

   What I don't understand it how a user would know that the following action will create a server called github with blank credentials?

   - uses: actions/setup-java@v1
       with:
           java-version: 1.8
   

   I assumed this action would simply setup Java 1.8.

   Using a default server name if credentials are specified would be one thing, but creating a default server with blank credentials when no server or credentials are specified seems surprising! 😕

   To put it another way, I don't understand how creating a creating a default server with blank credentials would help anyone. They won't be able to publish or consume packages using this server.

   👍React with 👍1Reacted by Maciej Kwidziński
3. joschi commented on May 24, 2020

   

   joschi

   on May 24, 2020

   Contributor

   More actions

   @jcansdale As far as I understand the code, the github server in the Maven configuration wouldn't be empty, but use GITHUB_ACTOR and GITHUB_TOKEN as credentials:

   setup-java/src/auth.ts

   Lines 44 to 60 in b74d5a6

   	export function generate(
   	id = DEFAULT_ID,
   	username = DEFAULT_USERNAME,
   	password = DEFAULT_PASSWORD
   	) {
   	return `
   	<settings>
   	<servers>
   	<server>
   	<id>${escapeXML(id)}</id>
   	<username>\${env.${escapeXML(username)}}</username>
   	<password>\${env.${escapeXML(password)}}</password>
   	</server>
   	</servers>
   	</settings>
   	`;
   	}

   The setup-java action also mentions that it's setting this up:

   creating settings.xml with server-id: github; environment variables: username=$GITHUB_ACTOR, password=$GITHUB_TOKEN, and gpg-passphrase=null
   

   https://github.com/actions/setup-java/runs/701460926?check_suite_focus=true#step:5:15

   To put it another way, I don't understand how creating a creating a default server with blank credentials would help anyone.

   Since it's using credentials for the GitHub repository the setup-java action is running in, you could use to it deploy artifacts in the local GitHub package repository:

   https://help.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-apache-maven-for-use-with-github-packages#authenticating-with-the-github_token
4. jcansdale commented on May 25, 2020

   

   jcansdale

   on May 25, 2020

   Author

   More actions

   @joschi ,

   As far as I understand the code, the github server in the Maven configuration wouldn't be empty, but use GITHUB_ACTOR and GITHUB_TOKEN as credentials:

   I wonder if this is working as intended?

   Here I change my server id to github, in the hope of using the automatic configuration:
   https://github.com/actions-packages-examples/maven-example/pull/7

   You can see this fails with:

   [ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy (default-deploy) on project my-app: Failed to retrieve remote metadata com.mycompany.app:my-app:1.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata com.mycompany.app:my-app:1.0-SNAPSHOT/maven-metadata.xml from/to github (https://maven.pkg.github.com/actions-packages-examples/maven-example): Authentication failed for https://maven.pkg.github.com/actions-packages-examples/maven-example/com/mycompany/app/my-app/1.0-SNAPSHOT/maven-metadata.xml 401 Unauthorized -> [Help 1]
   

   https://github.com/actions-packages-examples/maven-example/pull/7/checks?check_run_id=707268001#step:5:487

   Any idea what I'm doing wrong? 🤔
5. Marcono1234 commented on Jun 4, 2020

   

   Marcono1234

   on Jun 4, 2020

   Contributor

   More actions

   Related to #60
6. maxim-lobanov commented on Apr 8, 2021

   

   maxim-lobanov

   on Apr 8, 2021

   Contributor

   More actions

   Automatic creation of settings.xml with github server is intentional and intended for GitHub Package Registry. The necessity of enabling this functionality by default was discussed in #79
   Also this issue contains way to disable it if needs.
   I will close this issue as duplicate
7. maxim-lobanov

   closed this as completedon Apr 8, 2021