Gitea/GitHub Actions maven deploy causing 401 unauthorized

Question

I'm new to CI/CD, Gitea/GitHub, Docker and Maven. I've setup a self-hosted Gitea server and Runner. Before migrating all my projects, I'm testing CI/CD. For this purpose I've made test projects and now facing a maven deploy issue.

Here is the test project pom.xml (note : I've replaced real domain with "example") :

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.example.test</groupId>
    <artifactId>test-library-java</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>
    <name>TestLibraryJava</name>
    <description>
        Test library for gitea actions deploy
    </description>
    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>1.7</maven.compiler.source>
        <maven.compiler.target>1.7</maven.compiler.target>
    </properties>
    
    <repositories>
        <repository>
        <id>example</id>
            <url>https://git.example.com/api/packages/example/maven</url>
        </repository>
    </repositories>
    <distributionManagement>
        <repository>
            <id>example</id>
            <url>https://git.example.com/api/packages/example/maven</url>
        </repository>
        <snapshotRepository>
            <id>example</id>
            <url>https://git.example.com/api/packages/example/maven</url>
        </snapshotRepository>
    </distributionManagement>
</project>

Here is the test project build.yml :

name: Build Java software package

on:
  push

jobs:
    publish:
        runs-on: ubuntu-latest
        permissions:
            contents: read
            packages: write
        steps:
            - name: Checkout
              uses: https://github.com/actions/checkout@v3
              
            - name: Install Maven
              uses: https://github.com/stCarolas/setup-maven@v4
            
            - name: Install Java
              uses: https://github.com/actions/setup-java@v3
              with:
                distribution: temurin
                java-version: 18
                cache: maven
                overwrite-settings: true
                server-id: example
            
            - run: cat ~/.m2/settings.xml
            
            - name: Deploy
              run: mvn -B deploy

The result from cat :

<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
  <servers>
    <server>
      <id>example</id>
      <username>${env.GITHUB_ACTOR}</username>
      <password>${env.GITHUB_TOKEN}</password>
    </server>
  </servers>

The result from deploy (note : I've replaced real domain with "example") :

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.7:deploy (default-deploy) on project test-library-java: Failed to deploy artifacts: Could not transfer artifact com.example.test:test-library-java:jar:1.0.0 from/to example (https://git.example.com/api/packages/example/maven): Failed to transfer file: https://git.example.com/api/packages/example/maven/com/example/test/test-library-java/1.0.0/test-library-java-1.0.0.jar. Return code is: 401, ReasonPhrase: Unauthorized. -> [Help 1]

I've done some tests :

Deploy from development workstation using mvn deploy and token in settings.xml, this works.

Overriding container settings.xml with hardcoded password works

#            - name: Configure Maven
#              env:
#                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
#              run: echo "<settings><servers><server><id>example</id><username>$GITHUB_ACTOR</username><password>TOKENFROMGITEA</password></server></servers></settings>" > ~/.m2/settings.xml

So now I'm wondering if the settings.xml really have the environment variables replaced or if the actions provided GITHUB_TOKEN have the rights for packages/write. Also note that my user is the owner of the repository and admin of Gitea.

Versions used :

• Gitea 1.20.0-rc2
• Docker 20.10.18
• Containerd 1.6.8 9cd3357

Documentation used :

• Gitea Maven Package Registry
• GitHub actions/setup-java
• Gitea issue maven 401 closed

Answer 1

Finally after many trial and errors, I understood that Gitea doesn't support permission changes for the GITHUB_TOKEN so I've been able to create a personnal access token with packages read/write access.

Here is the final workflow :

name: Build Java software package

on:
  push
#    tags:
#      - "v*.*.*"

# Not tested but would probably work with GitHub but not Gitea yet
#permissions:
#  contents: read
#  packages: write

jobs:
    publish:
        runs-on: ubuntu-latest
        steps:
            - name: Checkout
              uses: https://github.com/actions/checkout@v3
              
            - name: Install Maven
              uses: https://github.com/stCarolas/setup-maven@v4
            
            - name: Install Java
              uses: https://github.com/actions/setup-java@v3
              with:
                distribution: temurin
                java-version: 18
                cache: maven
                overwrite-settings: true
                server-id: example
            
            - name: Deploy
              run: mvn -B deploy
              env:
                GITHUB_TOKEN: ${{ secrets.PACKAGES_TOKEN }}