Generate a personal access token (classic) to access maven reposiotry

[pawel-jedruch-swiftpay]

We do have two private repositories in our organization, let's call them: library and project. The library is hosted in the Maven GitHub repository. The project workflow is using a personal access token for authorization (according to documentation.

Now we want to migrate to actions/create-github-app-token, but I was unable to create a working solution.

.github/workflows/example.yml

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Get token from Github App
      uses: actions/create-github-app-token@v1
      id: app-token
      with:
        app-id: ${{ secrets.GET_TOKEN_APP_ID }}
        private-key: ${{ secrets.GET_TOKEN_APP_PRIVATE_KEY }}
        owner: ${{ github.repository_owner }}
 
    - name: Set up Maven
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'corretto'
        cache: 'maven'
        server-username: MAVEN_USERNAME
        server-password: MAVEN_PASSWORD

    - name: Build and Package
      run: |
        cd project
        mvn clean package
      env:
        MAVEN_USERNAME: ${{ github.actor }}
        MAVEN_PASSWORD: ${{ steps.app-token.outputs.token }}

I've tried multiple configurations but always end up with the following error:

Authentication failed for https://maven.pkg.github.com//repo/..., status: 401 Unauthorized -> [Help 1]

What I'm guessing is that create-github-app-token doesn't support a personal access token. Could you confirm if this is the case?

[gr2m]

What I'm guessing is that create-github-app-token doesn't support a personal access token. Could you confirm if this is the case?

That is correct, actions/create-github-app-token creates installation access token (server-to-server tokens). Personal access tokens cannot be created programmatically without user interaction.

Authentication failed for https://maven.pkg.github.com//repo/...

The // looks odd, maybe an argument is missing, like an org name? I'm not familiar with maven I'm afraid

[pawel-jedruch-swiftpay]

The // looks odd, maybe an argument is missing, like an org name? I'm not familiar with maven I'm afraid

Because of mine not so clever way of anonymization of the logs:

The full logs looks like that

Failed to execute goal on project project-name: Could not resolve dependencies for project :🫙1.0.0-SNAPSHOT: Failed to collect dependencies at :🫙1.0.0-SNAPSHOT: Failed to read artifact descriptor for :🫙1.0.0-SNAPSHOT Could not transfer artifact :🫙1.0.0-SNAPSHOT from/to github (https://maven.pkg.github.com//repo): authentication failed for https://maven.pkg.github.com/<organization-id/repo/com/example/artifactid/2.0.0/artifactid-2.0.0.pom, status: 401 Unauthorized -> [Help 1]

The configuration looks ok for me. When I use the classic access token for the MAVEN_PASSWORD variable, everything works as expected. As temporary solution it is ok with us, but it will be ideally to have something more robust without personal access token.

[gr2m]

yeah it seems only personal access tokens are currently supported:
https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages#about-scopes-and-permissions-for-package-registries

I would ask in https://github.com/orgs/community/discussions/categories/packages if there permission-based access is being worked on for packages, I don't know