Automatically creating a server called `github` can cause surprising errors

[jcansdale]

I was setting up a Maven workflow. Everything worked fine locally and I was able to publish using mvn deploy -D token=TOKEN. When I added the actions/setup-java@v1 action, things mysteriously started to fail.

It turned out it would work as long as my repository wasn't called github. You can see the workflow fails when I rename the repository/server from foobarbaz to github:
https://github.com/actions-packages-examples/maven-example/commit/b529abbd86131a0da8feb1a3404be5d93d4a63f3

If I user needs to consume any packages, they will need to create a server configuration for every repository they're consuming packages from. Having a server called github implicitly defined is likely to get in the way and cause confusion.

Could we make it so that that server-id needs to be explicitly set and isn't automatically created?

[joschi]

You can already override the Maven server ID with the action's server-id input and the ID github will be used by default:

setup-java/src/setup-java.ts

Line 21 in b74d5a6

const id = core.getInput('server-id', {required: false}) || undefined;

setup-java/src/auth.ts

Line 10 in b74d5a6

export const DEFAULT_ID = 'github';

My unscientific guess is, that this is the behavior helping the majority of all users and shouldn't be changed in order to avoid friction for the majority's use case.

https://github.com/actions/setup-java#publishing-using-apache-maven

[jcansdale]

@joschi,

My unscientific guess is, that this is the behavior helping the majority of all users and shouldn't be changed in order to avoid friction for the majority's use case.

What I don't understand it how a user would know that the following action will create a server called github with blank credentials?

- uses: actions/setup-java@v1
    with:
        java-version: 1.8

I assumed this action would simply setup Java 1.8.

Using a default server name if credentials are specified would be one thing, but creating a default server with blank credentials when no server or credentials are specified seems surprising! 😕

To put it another way, I don't understand how creating a creating a default server with blank credentials would help anyone. They won't be able to publish or consume packages using this server.

[joschi]

@jcansdale As far as I understand the code, the github server in the Maven configuration wouldn't be empty, but use GITHUB_ACTOR and GITHUB_TOKEN as credentials:

setup-java/src/auth.ts

Lines 44 to 60 in b74d5a6

	export function generate(
	id = DEFAULT_ID,
	username = DEFAULT_USERNAME,
	password = DEFAULT_PASSWORD
	) {
	return `
	<settings>
	<servers>
	<server>
	<id>${escapeXML(id)}</id>
	<username>\${env.${escapeXML(username)}}</username>
	<password>\${env.${escapeXML(password)}}</password>
	</server>
	</servers>
	</settings>
	`;
	}

The setup-java action also mentions that it's setting this up:

creating settings.xml with server-id: github; environment variables: username=$GITHUB_ACTOR, password=$GITHUB_TOKEN, and gpg-passphrase=null

https://github.com/actions/setup-java/runs/701460926?check_suite_focus=true#step:5:15

To put it another way, I don't understand how creating a creating a default server with blank credentials would help anyone.

Since it's using credentials for the GitHub repository the setup-java action is running in, you could use to it deploy artifacts in the local GitHub package repository:

https://help.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-apache-maven-for-use-with-github-packages#authenticating-with-the-github_token

[jcansdale]

@joschi ,

As far as I understand the code, the github server in the Maven configuration wouldn't be empty, but use GITHUB_ACTOR and GITHUB_TOKEN as credentials:

I wonder if this is working as intended?

Here I change my server id to github, in the hope of using the automatic configuration:
https://github.com/actions-packages-examples/maven-example/pull/7

You can see this fails with:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy (default-deploy) on project my-app: Failed to retrieve remote metadata com.mycompany.app:my-app:1.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata com.mycompany.app:my-app:1.0-SNAPSHOT/maven-metadata.xml from/to github (https://maven.pkg.github.com/actions-packages-examples/maven-example): Authentication failed for https://maven.pkg.github.com/actions-packages-examples/maven-example/com/mycompany/app/my-app/1.0-SNAPSHOT/maven-metadata.xml 401 Unauthorized -> [Help 1]

https://github.com/actions-packages-examples/maven-example/pull/7/checks?check_run_id=707268001#step:5:487

Any idea what I'm doing wrong? 🤔

[Marcono1234]

Related to #60

[maxim-lobanov]

Automatic creation of settings.xml with github server is intentional and intended for GitHub Package Registry. The necessity of enabling this functionality by default was discussed in #79
Also this issue contains way to disable it if needs.
I will close this issue as duplicate