Skip to content

Commit c3d7ccb

Browse files
brunoborgesCopilot
brunoborges
and
Copilot
authored
Clarify credential environment variable inputs (#1134)
* Clarify credential environment variable inputs Rename credential-related inputs to make their environment-variable semantics explicit while preserving deprecated aliases with migration warnings. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 70a3daa8-dbc9-4eb0-a57b-df198a459315 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <[email protected]> --------- Co-authored-by: Copilot Autofix powered by AI <[email protected]>
1 parent 46f6294 commit c3d7ccb

9 files changed

Lines changed: 184 additions & 75 deletions

File tree

‎.github/workflows/e2e-publishing.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ jobs:
3838
distribution: 'adopt'
3939
java-version: '11'
4040
server-id: maven
41-
server-username: MAVEN_USERNAME
42-
server-password: MAVEN_CENTRAL_TOKEN
43-
gpg-passphrase: MAVEN_GPG_PASSPHRASE
41+
server-username-env-var: MAVEN_USERNAME
42+
server-password-env-var: MAVEN_CENTRAL_TOKEN
43+
gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
4444
- name: Validate settings.xml
4545
run: |
4646
$xmlPath = Join-Path $HOME ".m2" "settings.xml"
@@ -93,9 +93,9 @@ jobs:
9393
distribution: 'adopt'
9494
java-version: '11'
9595
server-id: maven
96-
server-username: MAVEN_USERNAME
97-
server-password: MAVEN_CENTRAL_TOKEN
98-
gpg-passphrase: MAVEN_GPG_PASSPHRASE
96+
server-username-env-var: MAVEN_USERNAME
97+
server-password-env-var: MAVEN_CENTRAL_TOKEN
98+
gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
9999
- name: Validate settings.xml is overwritten
100100
run: |
101101
$xmlPath = Join-Path $HOME ".m2" "settings.xml"
@@ -131,10 +131,10 @@ jobs:
131131
distribution: 'adopt'
132132
java-version: '11'
133133
server-id: maven
134-
server-username: MAVEN_USERNAME
135-
server-password: MAVEN_CENTRAL_TOKEN
134+
server-username-env-var: MAVEN_USERNAME
135+
server-password-env-var: MAVEN_CENTRAL_TOKEN
136136
overwrite-settings: false
137-
gpg-passphrase: MAVEN_GPG_PASSPHRASE
137+
gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
138138
- name: Validate that settings.xml is not overwritten
139139
run: |
140140
$xmlPath = Join-Path $HOME ".m2" "settings.xml"
@@ -164,9 +164,9 @@ jobs:
164164
distribution: 'adopt'
165165
java-version: '11'
166166
server-id: maven
167-
server-username: MAVEN_USERNAME
168-
server-password: MAVEN_CENTRAL_TOKEN
169-
gpg-passphrase: MAVEN_GPG_PASSPHRASE
167+
server-username-env-var: MAVEN_USERNAME
168+
server-password-env-var: MAVEN_CENTRAL_TOKEN
169+
gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
170170
settings-path: ${{ runner.temp }}
171171
- name: Validate settings.xml location
172172
run: |

‎README.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@ This action allows you to work with Java and Scala projects.
2323
> [!NOTE]
2424
> V6 is still in development (`main` branch) and is not yet recommended for production workflows.
2525
26-
- **Migrated to ESM** to enable support for the latest `@actions/*` package versions. This is an internal implementation change only. No changes are required to your workflow configuration, and the action's behavior is unchanged. Existing workflows continue to work as before.
26+
- **Migrated to ESM** to enable support for the latest `@actions/*` package versions. This is an internal implementation change.
2727

2828
## Breaking changes in V6
2929

30-
- **The GPG passphrase is now passed to the Maven GPG Plugin through an environment variable (`gpg.passphraseEnvName`) instead of the deprecated `gpg.passphrase` server in `settings.xml`.** The `gpg-passphrase` input and its default (`GPG_PASSPHRASE`) are unchanged, so if you already set that environment variable in your build step your workflow keeps working. However, this now requires `maven-gpg-plugin` **3.2.0 or newer**; older versions do not honor `gpg.passphraseEnvName` and, because the `gpg.passphrase` server is no longer written, will not pick up the passphrase. Upgrade the plugin to 3.2.0+.
30+
- **Renamed inputs that accept environment-variable names** to make it clear that their values are not credentials. Replace `server-username`, `server-password`, and `gpg-passphrase` with `server-username-env-var`, `server-password-env-var`, and `gpg-passphrase-env-var`, respectively. The old names remain as deprecated aliases and emit a warning when used.
31+
32+
- **The GPG passphrase is now passed to the Maven GPG Plugin through an environment variable (`gpg.passphraseEnvName`) instead of the deprecated `gpg.passphrase` server in `settings.xml`.** Set the environment variable name with `gpg-passphrase-env-var`, which defaults to `GPG_PASSPHRASE`. This requires `maven-gpg-plugin` **3.2.0 or newer**; older versions do not honor `gpg.passphraseEnvName` and, because the `gpg.passphrase` server is no longer written, will not pick up the passphrase. Upgrade the plugin to 3.2.0+.
3133

3234
See [GPG](docs/advanced-usage.md#gpg) for details.
3335

@@ -75,15 +77,15 @@ For more details, see the full release notes on the [releases page](https://git
7577

7678
- `server-id`: ID of the distributionManagement repository in the pom.xml file. Default is `github`.
7779

78-
- `server-username`: Environment variable name for the username for authentication to the Apache Maven repository. Default is GITHUB\_ACTOR.
80+
- `server-username-env-var`: Environment variable name for the username for authentication to the Apache Maven repository. Default is GITHUB\_ACTOR.
7981

80-
- `server-password`: Environment variable name for password or token for authentication to the Apache Maven repository. Default is GITHUB\_TOKEN.
82+
- `server-password-env-var`: Environment variable name for password or token for authentication to the Apache Maven repository. Default is GITHUB\_TOKEN.
8183

8284
- `settings-path`: Maven related setting to point to the directory where the settings.xml file will be written. Default is \~/.m2.
8385

8486
- `gpg-private-key`: GPG private key to import. Default is empty string.
8587

86-
- `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is GPG\_PASSPHRASE.
88+
- `gpg-passphrase-env-var`: Environment variable name for the GPG private key passphrase. Default is GPG\_PASSPHRASE.
8789

8890
- `mvn-toolchain-id`: Name of Maven Toolchain ID if the default name of `${distribution}_${java-version}` is not wanted.
8991

‎__tests__/auth.test.ts‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,4 +270,55 @@ describe('auth tests', () => {
270270
expectedSettings
271271
);
272272
});
273+
274+
it('uses deprecated input aliases and warns', () => {
275+
const mockGetInput = core.getInput as jest.MockedFunction<
276+
typeof core.getInput
277+
>;
278+
const mockWarning = core.warning as jest.MockedFunction<
279+
typeof core.warning
280+
>;
281+
mockGetInput.mockImplementation(name =>
282+
name === 'server-username' ? 'LEGACY_USERNAME' : ''
283+
);
284+
285+
expect(
286+
auth.getInputWithDeprecatedAlias(
287+
'server-username-env-var',
288+
'server-username',
289+
'GITHUB_ACTOR'
290+
)
291+
).toBe('LEGACY_USERNAME');
292+
expect(mockWarning).toHaveBeenCalledWith(
293+
"The 'server-username' input is deprecated and may be removed in a future release. Please use 'server-username-env-var' instead."
294+
);
295+
296+
mockGetInput.mockReset();
297+
mockWarning.mockReset();
298+
});
299+
300+
it('prefers the replacement input over its deprecated alias', () => {
301+
const mockGetInput = core.getInput as jest.MockedFunction<
302+
typeof core.getInput
303+
>;
304+
mockGetInput.mockImplementation(name => {
305+
const inputs: Record<string, string> = {
306+
'server-password-env-var': 'NEW_PASSWORD',
307+
'server-password': 'LEGACY_PASSWORD'
308+
};
309+
return inputs[name] || '';
310+
});
311+
312+
expect(
313+
auth.getInputWithDeprecatedAlias(
314+
'server-password-env-var',
315+
'server-password',
316+
'GITHUB_TOKEN'
317+
)
318+
).toBe('NEW_PASSWORD');
319+
expect(core.warning).toHaveBeenCalled();
320+
321+
mockGetInput.mockReset();
322+
(core.warning as jest.Mock).mockReset();
323+
});
273324
});

‎action.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,16 +46,20 @@ inputs:
4646
file. Default is `github`'
4747
required: false
4848
default: 'github'
49-
server-username:
49+
server-username-env-var:
5050
description: 'Environment variable name for the username for authentication
5151
to the Apache Maven repository. Default is $GITHUB_ACTOR'
5252
required: false
53-
default: 'GITHUB_ACTOR'
54-
server-password:
53+
server-username:
54+
description: 'Deprecated alias for server-username-env-var'
55+
required: false
56+
server-password-env-var:
5557
description: 'Environment variable name for password or token for
5658
authentication to the Apache Maven repository. Default is $GITHUB_TOKEN'
5759
required: false
58-
default: 'GITHUB_TOKEN'
60+
server-password:
61+
description: 'Deprecated alias for server-password-env-var'
62+
required: false
5963
settings-path:
6064
description: 'Path to where the settings.xml file will be written. Default is ~/.m2.'
6165
required: false
@@ -67,8 +71,11 @@ inputs:
6771
description: 'GPG private key to import. Default is empty string.'
6872
required: false
6973
default: ''
74+
gpg-passphrase-env-var:
75+
description: 'Environment variable name for the GPG private key passphrase. Defaults to GPG_PASSPHRASE when gpg-private-key is set.'
76+
required: false
7077
gpg-passphrase:
71-
description: 'Environment variable name for the GPG private key passphrase. Defaults to GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.'
78+
description: 'Deprecated alias for gpg-passphrase-env-var'
7279
required: false
7380
cache:
7481
description: 'Name of the build platform to cache dependencies. It can be "maven", "gradle" or "sbt".'

‎dist/cleanup/index.js‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -95928,12 +95928,17 @@ const INPUT_PROBLEM_MATCHER = 'problem-matcher';
9592895928
const INPUT_VERIFY_SIGNATURE = 'verify-signature';
9592995929
const INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
9593095930
const INPUT_SERVER_ID = 'server-id';
95931-
const INPUT_SERVER_USERNAME = 'server-username';
95932-
const INPUT_SERVER_PASSWORD = 'server-password';
95931+
const INPUT_SERVER_USERNAME_ENV_VAR = 'server-username-env-var';
95932+
const INPUT_SERVER_PASSWORD_ENV_VAR = 'server-password-env-var';
95933+
const INPUT_SERVER_USERNAME_DEPRECATED = 'server-username';
95934+
const INPUT_SERVER_PASSWORD_DEPRECATED = 'server-password';
9593395935
const INPUT_SETTINGS_PATH = 'settings-path';
9593495936
const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings';
9593595937
const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
95936-
const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
95938+
const INPUT_GPG_PASSPHRASE_ENV_VAR = 'gpg-passphrase-env-var';
95939+
const INPUT_GPG_PASSPHRASE_DEPRECATED = 'gpg-passphrase';
95940+
const INPUT_DEFAULT_SERVER_USERNAME = 'GITHUB_ACTOR';
95941+
const INPUT_DEFAULT_SERVER_PASSWORD = 'GITHUB_TOKEN';
9593795942
const INPUT_DEFAULT_GPG_PRIVATE_KEY = (/* unused pure expression or super */ null && (undefined));
9593895943
const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
9593995944
// The default name of the environment variable the maven-gpg-plugin reads the

‎dist/setup/index.js‎

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -73287,12 +73287,17 @@ const INPUT_PROBLEM_MATCHER = 'problem-matcher';
7328773287
const INPUT_VERIFY_SIGNATURE = 'verify-signature';
7328873288
const INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
7328973289
const INPUT_SERVER_ID = 'server-id';
73290-
const INPUT_SERVER_USERNAME = 'server-username';
73291-
const INPUT_SERVER_PASSWORD = 'server-password';
73290+
const INPUT_SERVER_USERNAME_ENV_VAR = 'server-username-env-var';
73291+
const INPUT_SERVER_PASSWORD_ENV_VAR = 'server-password-env-var';
73292+
const INPUT_SERVER_USERNAME_DEPRECATED = 'server-username';
73293+
const INPUT_SERVER_PASSWORD_DEPRECATED = 'server-password';
7329273294
const INPUT_SETTINGS_PATH = 'settings-path';
7329373295
const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings';
7329473296
const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
73295-
const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
73297+
const INPUT_GPG_PASSPHRASE_ENV_VAR = 'gpg-passphrase-env-var';
73298+
const INPUT_GPG_PASSPHRASE_DEPRECATED = 'gpg-passphrase';
73299+
const INPUT_DEFAULT_SERVER_USERNAME = 'GITHUB_ACTOR';
73300+
const INPUT_DEFAULT_SERVER_PASSWORD = 'GITHUB_TOKEN';
7329673301
const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined;
7329773302
const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
7329873303
// The default name of the environment variable the maven-gpg-plugin reads the
@@ -127359,34 +127364,41 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
127359127364

127360127365
async function configureAuthentication() {
127361127366
const id = getInput(INPUT_SERVER_ID);
127362-
const username = getInput(INPUT_SERVER_USERNAME);
127363-
const password = getInput(INPUT_SERVER_PASSWORD);
127367+
const usernameEnvVar = getInputWithDeprecatedAlias(INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME);
127368+
const passwordEnvVar = getInputWithDeprecatedAlias(INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_DEFAULT_SERVER_PASSWORD);
127364127369
const settingsDirectory = getInput(INPUT_SETTINGS_PATH) ||
127365127370
external_path_.join(external_os_.homedir(), M2_DIR);
127366127371
const overwriteSettings = util_getBooleanInput(INPUT_OVERWRITE_SETTINGS, true);
127367127372
const gpgPrivateKey = getInput(INPUT_GPG_PRIVATE_KEY) ||
127368127373
INPUT_DEFAULT_GPG_PRIVATE_KEY;
127369-
const gpgPassphrase = getInput(INPUT_GPG_PASSPHRASE) ||
127370-
(gpgPrivateKey ? INPUT_DEFAULT_GPG_PASSPHRASE : undefined);
127374+
const gpgPassphraseEnvVar = getInputWithDeprecatedAlias(INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, gpgPrivateKey ? INPUT_DEFAULT_GPG_PASSPHRASE : undefined);
127371127375
if (gpgPrivateKey) {
127372127376
core_setSecret(gpgPrivateKey);
127373127377
}
127374-
await createAuthenticationSettings(id, username, password, settingsDirectory, overwriteSettings, gpgPassphrase);
127378+
await createAuthenticationSettings(id, usernameEnvVar, passwordEnvVar, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar);
127375127379
if (gpgPrivateKey) {
127376127380
info('Importing private gpg key');
127377127381
const keyFingerprint = (await importKey(gpgPrivateKey)) || '';
127378127382
saveState(STATE_GPG_PRIVATE_KEY_FINGERPRINT, keyFingerprint);
127379127383
}
127380127384
}
127381-
async function createAuthenticationSettings(id, username, password, settingsDirectory, overwriteSettings, gpgPassphrase = undefined) {
127385+
function getInputWithDeprecatedAlias(inputName, deprecatedInputName, defaultValue) {
127386+
const value = getInput(inputName);
127387+
const deprecatedValue = getInput(deprecatedInputName);
127388+
if (deprecatedValue) {
127389+
warning(`The '${deprecatedInputName}' input is deprecated and may be removed in a future release. Please use '${inputName}' instead.`);
127390+
}
127391+
return value || deprecatedValue || defaultValue || '';
127392+
}
127393+
async function createAuthenticationSettings(id, usernameEnvVar, passwordEnvVar, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar = undefined) {
127382127394
info(`Creating ${MVN_SETTINGS_FILE} with server-id: ${id}`);
127383127395
// when an alternate m2 location is specified use only that location (no .m2 directory)
127384127396
// otherwise use the home/.m2/ path
127385127397
await mkdirP(settingsDirectory);
127386-
await write(settingsDirectory, generate(id, username, password, gpgPassphrase), overwriteSettings);
127398+
await write(settingsDirectory, generate(id, usernameEnvVar, passwordEnvVar, gpgPassphraseEnvVar), overwriteSettings);
127387127399
}
127388127400
// only exported for testing purposes
127389-
function generate(id, username, password, gpgPassphrase) {
127401+
function generate(id, usernameEnvVar, passwordEnvVar, gpgPassphraseEnvVar) {
127390127402
const xmlObj = {
127391127403
settings: {
127392127404
'@xmlns': 'http://maven.apache.org/SETTINGS/1.0.0',
@@ -127397,8 +127409,8 @@ function generate(id, username, password, gpgPassphrase) {
127397127409
server: [
127398127410
{
127399127411
id: id,
127400-
username: `\${env.${username}}`,
127401-
password: `\${env.${password}}`
127412+
username: `\${env.${usernameEnvVar}}`,
127413+
password: `\${env.${passwordEnvVar}}`
127402127414
}
127403127415
]
127404127416
}
@@ -127410,13 +127422,13 @@ function generate(id, username, password, gpgPassphrase) {
127410127422
// otherwise the plugin already reads the right variable and no extra settings
127411127423
// are needed. Writing `gpg.passphrase` to settings.xml is deprecated and fails
127412127424
// when the plugin's `bestPractices` mode is enabled.
127413-
if (gpgPassphrase &&
127414-
gpgPassphrase !== MAVEN_GPG_PASSPHRASE_DEFAULT_ENV) {
127425+
if (gpgPassphraseEnvVar &&
127426+
gpgPassphraseEnvVar !== MAVEN_GPG_PASSPHRASE_DEFAULT_ENV) {
127415127427
xmlObj.settings.profiles = {
127416127428
profile: {
127417127429
id: GPG_PASSPHRASE_PROFILE_ID,
127418127430
properties: {
127419-
'gpg.passphraseEnvName': gpgPassphrase
127431+
'gpg.passphraseEnvName': gpgPassphraseEnvVar
127420127432
}
127421127433
}
127422127434
};

0 commit comments

Comments
 (0)