advanced-security / maven-dependency-submission-action

GitHub Action for submitting Maven dependencies
MIT License
48 stars 25 forks source link

Bad Credentials in 4.0.1 #66

Open balza opened 8 months ago

balza commented 8 months ago

Hello, I've upgraded the library in Jenkins build agent image to the latest 4.0.1 from 3.0.3 I've upgraded only maven-dependency-submission-action and left all other configurations intact, with the following call

maven-dependency-tree-submission-linux -t "${GIT_TOKEN}" -r "az-italy/${REPOSITORY_NAME}" -b "refs/heads/${BRANCH}" --github-api-url "https://my-github.com/api/v3" -s "${COMMIT_SHA}" --ignore-maven-wrapper

now I get

"name": "maven-dependency-submission-action",%0A        "url": "https://github.com/advanced-security/maven-dependency-submission-action",%0A        "version": "4.0.1"%0A    }%0A}
::error::HTTP Status 401 for request POST https://api.github.com/repos/az-italy/alwaysbuild-maven/dependency-graph/snapshots
::error::Response body:%0A{%0A  "message": "Bad credentials",%0A  "documentation_url": "https://docs.github.com/rest"%0A}
::error::Bad credentials
::error::HttpError: Bad credentials%0A    at /snapshot/maven-dependency-submission-action/output/cli.js%0A    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)%0A    at async L (/snapshot/maven-dependency-submission-action/output/cli.js)
Failed to submit the dependency snapshot, check logs for more details, Error: Failed to submit snapshot: HttpError: Bad credentials
Error: Failed to submit snapshot: HttpError: Bad credentials
    at L (/snapshot/maven-dependency-submission-action/output/cli.js)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
Failed to submit snapshot: HttpError: Bad credentials

the library is trying to POST the snapshot to https://api.github.com/repos/az-italy/alwaysbuild-maven/dependency-graph/snapshots and not to my organization github's API

Thanks

peter-murray commented 6 months ago

In version 4.0.3 this appears to work correctly now, can you verify?