401 Unauthorized when run mvn deploy on package contains a maven dependency of GitHub Packages

[zluo01]

Description: I need to deploy a package to github maven. This repo depends on a private github maven packages. I have setup the settings.xml through whelk-io/maven-settings-xml-action@v22. I can built it with mvn --batch-mode --update-snapshots verify successfully but fail with 401 when try to deploy the github package with permission error.

I have confirm in the build log that, the github maven dependency is downloaded properly during build.

Task version: v4

Platform:

• [x] Ubuntu (github action)
• [ ] macOS
• [ ] Windows

Runner type:

• [x] Hosted
• [ ] Self-hosted

Repro steps:

  publish:
    runs-on: ubuntu-latest
    needs: [ build ]
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'corretto'
      - uses: whelk-io/maven-settings-xml-action@v22
        with:
          repositories: >
            [
              {
                  "id": "github",
                  "url": "https://maven.pkg.github.com/<name>/<github-repo>"
              }
            ]
          servers: >
            [
              {
                "id":"github",
                "username":"${{ github.actor }}",
                "password":"${{ secrets.REPO_TOKEN }}"
              }
            ]
      - name: Publish package
        run: mvn --batch-mode -e -X deploy
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Expected behavior: Able to deploy package to github package

Actual behavior: Failed to deploy artifacts: Could not transfer artifact ...status code: 401, reason phrase: Unauthorized (401)

[zluo01]

Previously seen similar issue https://github.com/actions/setup-java/issues/432

[HarithaVattikuti]

Hello @zluo01 Thank you for creating this issue. We will investigate it and get back to you as soon as we have some feedback.

[zluo01]

Hi, any follow up on this problem will be appreciated.

[mahabaleshwars]

Hello @zluo01, I am able to publish package by using classic tokens. Could you please confirm if this solution works for you too? If it doesn't, could you specify how you're generating the token? This information will aid in further investigation

[zluo01]

@mahabaleshwars Which solution you are referring to ? The token I use secrets.GITHUB_TOKEN is provided by github action itself.

I have the same thing and it works in other private repo.

I still get following error. This repo is also a private repo that have a dependency of another private repo maven package. I am not sure if it can be related to this setup.

Error:  Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.7:deploy (default-deploy) on project repo: Failed to deploy artifacts: Could not transfer artifact com.github.zluo01:repo:jar:1.0.0 from/to github (https://maven.pkg.github.com/zluo01/repo): authentication failed for https://maven.pkg.github.com/zluo01/repo/com/github/zluo01/repo/1.0.0/repo-1.0.0.jar, status: 401 Unauthorized -> [Help 1]

[mahabaleshwars]

Hello @zluo01,I'm unable to replicate the problem you're experiencing. Could you provide a more detailed sequence of steps to recreate the issue? Also, please note that the Personal Access Token generated using classic token should be utilized in conjunction with REPO_TOKEN.

[zluo01]

@mahabaleshwars I am able to reproduce this just by creating two repo where TestA is a dependency of TestB and I try to publish TestB as maven repo. REPO_TOKEN is a generated classic token that has only read:package permission.

https://github.com/zluo01/TestA https://github.com/zluo01/TestB

Following is the error: https://github.com/zluo01/TestB/actions/runs/8564533848/job/23471225058

[mahabaleshwars]

Hi @zluo01, I was able to reproduce the issue you're facing by following the steps you provided. It appears the problem is tied to the 'read:packages' permission currently set for publishing. To fix this, you need to switch the permission to 'write:packages' for your Repo_Token in your secrets. Could you please try making this change?

[zluo01]

@mahabaleshwars Thanks for the help. I have confirm that adding write permission solve the problem. Does not expect the permission on dependency has impact on publishing the package.