I'm new to CI/CD, Gitea/GitHub, Docker and Maven. I've setup a self-hosted Gitea server and Runner. Before migrating all my projects, I'm testing CI/CD. For this purpose I've made test projects and now facing a maven deploy issue.

Here is the test project `pom.xml` (note : I've replaced real domain with `"example"`) :

    <?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <groupId>com.example.test</groupId>
        <artifactId>test-library-java</artifactId>
        <version>1.0.0</version>
        <packaging>jar</packaging>
    	<name>TestLibraryJava</name>
    	<description>
    		Test library for gitea actions deploy
    	</description>
        <properties>
            <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
            <maven.compiler.source>1.7</maven.compiler.source>
            <maven.compiler.target>1.7</maven.compiler.target>
        </properties>
    	
    	<repositories>
    		<repository>
    		<id>example</id>
    			<url>https://git.example.com/api/packages/example/maven</url>
    		</repository>
    	</repositories>
    	<distributionManagement>
    		<repository>
    			<id>example</id>
    			<url>https://git.example.com/api/packages/example/maven</url>
    		</repository>
    		<snapshotRepository>
    			<id>example</id>
    			<url>https://git.example.com/api/packages/example/maven</url>
    		</snapshotRepository>
    	</distributionManagement>
    </project>

Here is the test project `build.yml` :

    name: Build Java software package
    
    on:
      push
    
    jobs:
        publish:
            runs-on: ubuntu-latest
            permissions:
                contents: read
                packages: write
            steps:
                - name: Checkout
                  uses: https://github.com/actions/checkout@v3
                  
                - name: Install Maven
                  uses: https://github.com/stCarolas/setup-maven@v4
                
                - name: Install Java
                  uses: https://github.com/actions/setup-java@v3
                  with:
                    distribution: temurin
                    java-version: 18
                    cache: maven
                    overwrite-settings: true
                
                - run: cat ~/.m2/settings.xml
                
                - name: Deploy
                  run: mvn -B deploy

The result from cat :

    <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
      <servers>
        <server>
          <id>github</id>
          <username>${env.GITHUB_ACTOR}</username>
          <password>${env.GITHUB_TOKEN}</password>
        </server>
      </servers>

The result from deploy (note : I've replaced real domain with `"example"`) :

    [ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.7:deploy (default-deploy) on project test-library-java: Failed to deploy artifacts: Could not transfer artifact com.example.test:test-library-java:jar:1.0.0 from/to example (https://git.example.com/api/packages/example/maven): Failed to transfer file: https://git.example.com/api/packages/example/maven/com/example/test/test-library-java/1.0.0/test-library-java-1.0.0.jar. Return code is: 401, ReasonPhrase: Unauthorized. -> [Help 1]

I've done some tests :

Deploy from development workstation using `mvn deploy` and token in `settings.xml`, this works.

Overriding container `settings.xml` with hardcoded password works

    #            - name: Configure Maven
    #              env:
    #                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    #              run: echo "<settings><servers><server><id>example</id><username>$GITHUB_ACTOR</username><password>TOKENFROMGITEA</password></server></servers></settings>" > ~/.m2/settings.xml

So now I'm wondering if the `settings.xml` really have the environment variables replaced or if the actions provided GITHUB_TOKEN have the rights for packages/write. Also note that my user is the owner of the repository and admin of Gitea.

Versions used :

 - Gitea 1.20.0-rc2
 - Docker 20.10.18
 - Containerd 1.6.8 9cd3357

Documentation used :

 - [Gitea Maven Package Registry][1]
 - [GitHub actions/setup-java][2]
 - [Gitea issue maven 401 closed][3]

  [1]: https://docs.gitea.com/next/usage/packages/maven
  [2]: https://github.com/actions/setup-java
  [3]: https://github.com/go-gitea/gitea/issues/23575