Research GitHub Packages as a new repo

[jsi]

• Is it possible to move our entire old repo into Packages?
• Who is using Artifactory API and how? (CLI, market, Gradle plugin, old enonic download)
• How does pricing work?
• What can we put there? Only our own things?
• Mix and match private and public?

[edloidas]

GitHub Packages

About GitHub Packages

• GitHub Packages Feature

• You can publish packages in a public repository (public packages) to share with all of GitHub, or in a private repository (private packages) to share with collaborators or an organization. You can use GitHub roles and teams to limit who can install or publish each package, as packages inherit the permissions of the repository.

• You need an access token to publish, install, and delete packages in GitHub Packages. You can use a personal access token to authenticate with your username directly to GitHub Packages or the GitHub API. You can use a GITHUB_TOKEN to authenticate using a GitHub Actions workflow.

Pricing & Billing

• GitHub Packages usage is free for public packages. For private packages, each GitHub account receives a certain amount of free storage and data transfer, depending on the product used with the account. By default, your account will have a spending limit of $0, which prevents additional usage of storage or data transfer after you reach the included amounts. If you increase your spending limit above the default of $0, you will be billed for any additional storage or data transfer, also called overages, up to your spending limit. For more information, see "About billing for GitHub Packages."
• Traffic is only counted outside GitHub Actions. We may need to switch to this CI.
• All other data transferred out from private packages, such as for local builds, is not free.
• Storage usage is shared with build artifacts produced by GitHub Actions for repositories owned by your account. For more information, see "About billing for GitHub Actions."
• GitHub Team plan may not be enough.
• We are already paying for the GitHub Team plan.
• There are 21 members and 4 contributors.

Package Clients

Package client	Language	Package format	Description
npm	JavaScript	package.json	Node package manager
gem	Ruby	Gemfile	RubyGems package manager
mvn	Java	pom.xml	Apache Maven project management and comprehension tool
gradle	Java	build.gradle or build.gradle.kts	Gradle build automation tool for Java
docker	N/A	Dockerfile	Docker container management platform
dotnet CLI	.NET	nupkg	NuGet package management for .NET

Publishing Package

See @Codertocat/hello-world-npm for an package example.

Siteimprove Application

The Siteimprove package has been published to packages.

The list of packages for the repo is accessible through the package button on the code panel next to the branches.

The app-siteimprove list of packages can be found here.

Publishing Siteimprove Application

plugins {
    id 'maven-publish'
    // Disable Gradle default plugin, since it's currently doing the same, but published to different URL
    //  id 'com.enonic.defaults' version '2.0.1'
}

publishing {
    repositories {
        maven {
            name = "GitHubPackages"
            url = uri("https://maven.pkg.github.com/enonic/app-siteimprove")
            credentials {
                username = project.findProperty("user") ?: System.getenv("GITHUB_USERNAME")
                password = project.findProperty("token") ?: System.getenv("GITHUB_TOKEN")
            }
        }

    }
    publications {
        gpr(MavenPublication) {
            from(components.java)
        }
    }
}

To publish packages simply run publish task, passing your data as parameters.

gradle publish -x lint -Puser=username -Ptoken=81ee323a14e1f667ab2db7935ecf66331cd9bc3b

GitHub Token

To publish or install packages from GitHub you need to generate a personal token with proper rights.

• Authenticating with the GITHUB_TOKEN

Installing Package

Just add published package as a dependency and a related repository:

repositories {
    maven {
        name "github"
        // To target the single (namespace) repo, use:
        // https://maven.pkg.github.com/enonic/app-siteimprove
        // Using `*` will target all repos of the organization
        url "https://maven.pkg.github.com/enonic/*"
        credentials {
            username "username"
            password "81ee323a14e1f667ab2db7935ecf66331cd9bc3b"
        }
    }
}

dependencies {
    compile "com.enonic.app:siteimprove:1.4.2"
}

FAQ

Q: Is it possible to move our entire old repo into Packages? A: Only manually and it's a big piece of work.

Q: Who is using Artifactory API and how? (CLI, market, Gradle plugin, old Enonic download) A: CLI to fetch bundle versions, gradle-defaults plugin for publishing bundles; maybe more?

Q: How does pricing work? A: See the "Pricing & Billing" section.

Q: What can we put there? Only our own things? A: Everything. But we should find if it's reasonable to put 'em there and the license allows that.

Q: Mix and match private and public? A: Yes, you can. To upload and download packages from GitHub you need to configure your tools, be authenticated and have rights to do interact with the repository, that package belongs to. As for the billing, you will only pay for the private repos.

---

Q: Where can I find the list of packages? A: Under the organization's Packages tab.

Q: Does the GitHub has the API to work with packages? A: Yes, it does have the API. Here is a user example of listing all the packages from the registry.

[edloidas]

GitHub Packages ±

Pros

• No need to pay for the public repositories and their packages. In the end, it'll probably be much cheaper.
• Fits into the GitHub-only workflow.
• Easy to set up and publish. We don't need to change much to make things work.

Cons

• Installing packages from the registry requires authentification to GitHub Packages with a username and token;
  Upd: The GitHub Packages are currently in beta and there is a high demand on the ability to install public packages without authentification. GitHub is working on it and may make it possible this year.
• Published packages can't be updated or removed;
• Packages can be accessed by the direct URL or from the package page, that resembles one from the npm. That's quite different from the approach, used by Artifactory and access to files in FTP-like style.
• We can't upload the whole legacy versions automatically.

[edloidas]

• Can we remove the third-party libraries from our Enonic repo? We have Apache and other bundles stored there, that we may not use. All that stuff is available from public repositories.
• Can we move to the GitHub Packages only for the new versions, leaving old versions in the old repo?

[jsi]

Great work here. Seems the Cons are too many, so for now, we are just staying with our current solution of operating Artifactory ourselves. Turned out to be some simpler ways of doing it.