Repository navigation
feat: support Maven server credential origins - #1282
Merged
brunoborges merged 4 commits intoOct 7, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Origin parsing accepts malformed values and can normalize non-HTTP ports incompatibly with Maven.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Adds Maven 3.10 repository-origin scoping for generated server credentials.
Changes:
- Adds and validates
mvn-server-repository-origins. - Emits
<repositoryOrigins>in Maven settings. - Updates tests, documentation, and distribution bundles.
| File | Description |
|---|---|
src/constants.ts |
Defines the new input. |
src/auth.ts |
Parses origins and generates XML. |
README.md |
Documents the input. |
docs/advanced-usage.md |
Adds multi-server examples. |
action.yml |
Exposes the action input. |
__tests__/auth.test.ts |
Tests parsing and generation. |
dist/setup/index.js |
Updates the setup bundle. |
dist/setup/81.index.js |
Bundles authentication logic. |
dist/cleanup/index.js |
Updates bundled constants. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+196
to
+200
| let url: URL; | ||
| try { | ||
| url = new URL(value); | ||
| } catch { | ||
| throw new Error( |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
4 tasks
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This was referenced Oct 7, 2026
This was referenced Oct 10, 2026
This was referenced Oct 12, 2026
stbischof
added a commit
to osgi/.github
that referenced
this pull request
Oct 12, 2026
Maven 3.10.0 on the runner image offers server credentials only to the origins bound to the server id. The id central is bound to repo.maven.apache.org, so the token is withheld from central.sonatype.com and the snapshot deploy fails with HTTP 401. credentialScope=id restores the id-only matching until setup-java releases mvn-server-repository-origins (actions/setup-java#1282, release asked in actions/setup-java#1284). Signed-off-by: Stefan Bischof <stbischof@bipolis.org>
stbischof
added a commit
to eclipse-daanse/.github
that referenced
this pull request
Oct 12, 2026
Maven 3.10.0 on the runner image offers server credentials only to the origins bound to the server id. The id central is bound to repo.maven.apache.org, so the token is withheld from central.sonatype.com and the snapshot deploy fails with HTTP 401. credentialScope=id restores the id-only matching until setup-java releases mvn-server-repository-origins (actions/setup-java#1282, release asked in actions/setup-java#1284). Signed-off-by: Stefan Bischof <stbischof@bipolis.org>
|
I wanted to ask if this one could be released as e.g. 6.0.2 (or 6.1.0)? With the current latest 6.0.1 it seems not possible to avoid a warning about the missing in settings.xml when publishing to Sonatype Central. I have tried to pin setup-java to 2a69be2, and it works like a charm and fixes the warnings, but if possible I would prefer to pin to a version tag. Thank you! |
3 of 19 tasks
1 task
|
Thank you very much, @YunaBraska and @brunoborges (and the rest!) 🙌 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Maven 3.10 scopes a
settings.xmlserver credential to repository origins.setup-javacan generate Maven server credentials, but cannot declare the corresponding<repositoryOrigins>. When a publisher resolves a repository dynamically, such as Central Publishing usinghttps://central.sonatype.com, Maven intentionally withholds the configured credential and deployment fails with HTTP 401.This is the behaviour introduced by Maven 3.10: release notes, settings reference, and implementation change.
Consumers currently have to patch the
settings.xmlgenerated by this action after every setup step.What
mvn-server-repository-origins, a multilineserver-id:repository-origininput.<repositoryOrigins>within the matching Maven server.Example:
Verification
npm run check