GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — feat: support Maven server credential origins by YunaBraska · Pull Request #1282 · actions/setup-java

Conversation

@YunaBraska

@YunaBraska YunaBraska commented Oct 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Why

Maven 3.10 scopes a settings.xml server credential to repository origins. setup-java can generate Maven server credentials, but cannot declare the corresponding <repositoryOrigins>. When a publisher resolves a repository dynamically, such as Central Publishing using https://central.sonatype.com, Maven intentionally withholds the configured credential and deployment fails with HTTP 401.

This is the behaviour introduced by Maven 3.10: release notes, settings reference, and implementation change.

Consumers currently have to patch the settings.xml generated by this action after every setup step.

What

  • Add mvn-server-repository-origins, a multiline server-id:repository-origin input.
  • Generate <repositoryOrigins> within the matching Maven server.
  • Normalize origins and reject malformed values, paths, credentials, query strings, fragments, and unknown server IDs.
  • Document Central Publishing and multi-server use.

Example:

with:
  server-id: central
  server-username-env-var: CENTRAL_USER
  server-password-env-var: CENTRAL_PASS
  mvn-server-repository-origins: |
    central:https://central.sonatype.com

Verification

npm run check

  • 45 test suites passed
  • 1,523 tests passed
  • format, lint, bundle build, and coverage all passed

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@YunaBraska
feat: support Maven server credential origins
fc9c9a1
@YunaBraska
YunaBraska requested a review from a team as a code owner October 5, 2026 16:31
@brunoborges
brunoborges requested a balanced review from Copilot October 5, 2026 17:04
Copilot started reviewing on behalf of brunoborges October 5, 2026 17:04
View session
Copilot AI reviewed Oct 5, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Origin parsing accepts malformed values and can normalize non-HTTP ports incompatibly with Maven.

Review effort: Balanced
Findings: 2 Medium severity

Open (2)
  • Medium severity Validate raw repository URL syntax before WHATWG normalization · New
  • Medium severity Preserve explicit non-HTTP(S) ports in Maven origin matching · New
What changed in this PR

Adds Maven 3.10 repository-origin scoping for generated server credentials.

Changes:

  • Adds and validates mvn-server-repository-origins.
  • Emits <repositoryOrigins> in Maven settings.
  • Updates tests, documentation, and distribution bundles.
File Description
src/​constants.ts Defines the new input.
src/​auth.ts Parses origins and generates XML.
README.md Documents the input.
docs/​advanced-usage.md Adds multi-server examples.
action.yml Exposes the action input.
__tests__/​auth.test.ts Tests parsing and generation.
dist/​setup/​index.js Updates the setup bundle.
dist/​setup/​81.index.js Bundles authentication logic.
dist/​cleanup/​index.js Updates bundled constants.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Comment thread src/auth.ts
Comment on lines +196 to +200
let url: URL;
try {
url = new URL(value);
} catch {
throw new Error(
Comment thread src/auth.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

brunoborges and others added 2 commits October 6, 2026 02:15
@brunoborges
Refactor origin construction to include port if necessary
133a926
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
@YunaBraska
fix: validate Maven server credential origins
9e1ebb6
@UncleOwen UncleOwen mentioned this pull request Oct 6, 2026
Fix #7153: Add -Dmaven.repository.credentialScope=id to ./mvnw deploy pmd/pmd#7155
Closed
4 tasks
@adangel adangel mentioned this pull request Oct 6, 2026
[ci] deploy-to-maven-central fails after update to maven 3.10.0 pmd/pmd#7153
Closed
@brunoborges
docs: note mvn-server-repository-origins requires Maven 3.10+
cf1a63f
Co-authored-by: Copilot App <[email protected]>
@brunoborges
brunoborges merged commit 2a69be2 into actions:main Oct 7, 2026
84 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@YunaBraska
YunaBraska deleted the feature/maven-server-origins branch October 7, 2026 15:24
This was referenced Oct 7, 2026
Fix snapshot deploy 401 on Maven 3.10 graphql-java-kickstart/graphql-java-tools#840
Merged
Declare central.sonatype.com as a repository origin once setup-java supports it graphql-java-kickstart/graphql-java-tools#841
Closed
This was referenced Oct 7, 2026
Fix snapshot deploy 401 on Maven 3.10; upgrade llama.cpp to b11476 bernardladenthin/java-llama.cpp#482
Merged
CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10) bernardladenthin/BitcoinAddressFinder#378
Merged
CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10) bernardladenthin/streambuffer#171
Merged
CI: pass -Dmaven.repository.credentialScope=id to every deploy (Maven 3.10) bernardladenthin/srcmorph#215
Merged
@mbastian mbastian mentioned this pull request Oct 8, 2026
Restore id-only credential matching for the CI deploy gephi/graphstore#305
Merged
This was referenced Oct 10, 2026
Declare Sonatype credential origins once setup-java releases support safere/safere#999
Closed
Fix Central publishing credential lookup on Maven 3.10 safere/safere#1000
Merged
@stbischof stbischof mentioned this pull request Oct 11, 2026
Release request: ship Maven credential origins (#1282). Maven 3.10 breaks Central snapshot deploys #1284
Closed
@lyang lyang mentioned this pull request Oct 11, 2026
ci: restore id-only Maven credential matching for Central snapshots bytestreams-io/exchange-core#71
Merged
@EvaristeGalois11 EvaristeGalois11 mentioned this pull request Oct 11, 2026
Build: Fix snapshot deploy with Maven 3.10 instancio/instancio#1896
Merged
@lyang lyang mentioned this pull request Oct 11, 2026
ci: restore id-only Maven credential matching for Central snapshots bytestreams-io/codec-core#167
Merged
This was referenced Oct 12, 2026
Deploy: temporary maven.repository.credentialScope=id for Maven 3.10 osgi/.github#13
Merged
Deploy: temporary maven.repository.credentialScope=id for Maven 3.10 eclipse-daanse/.github#57
Merged
stbischof added a commit to osgi/.github that referenced this pull request Oct 12, 2026
@stbischof
Deploy: temporary maven.repository.credentialScope=id for Maven 3.10
ddb385f
Maven 3.10.0 on the runner image offers server credentials only to the
origins bound to the server id. The id central is bound to
repo.maven.apache.org, so the token is withheld from central.sonatype.com
and the snapshot deploy fails with HTTP 401.

credentialScope=id restores the id-only matching until setup-java
releases mvn-server-repository-origins (actions/setup-java#1282, release
asked in actions/setup-java#1284).

Signed-off-by: Stefan Bischof <[email protected]>
stbischof added a commit to eclipse-daanse/.github that referenced this pull request Oct 12, 2026
@stbischof
Deploy: temporary maven.repository.credentialScope=id for Maven 3.10
2a99e8c
Maven 3.10.0 on the runner image offers server credentials only to the
origins bound to the server id. The id central is bound to
repo.maven.apache.org, so the token is withheld from central.sonatype.com
and the snapshot deploy fails with HTTP 401.

credentialScope=id restores the id-only matching until setup-java
releases mvn-server-repository-origins (actions/setup-java#1282, release
asked in actions/setup-java#1284).

Signed-off-by: Stefan Bischof <[email protected]>
@runeflobakk

runeflobakk commented Oct 13, 2026

Copy link
Copy Markdown

I wanted to ask if this one could be released as e.g. 6.0.2 (or 6.1.0)? With the current latest 6.0.1 it seems not possible to avoid a warning about the missing in settings.xml when publishing to Sonatype Central. I have tried to pin setup-java to 2a69be2, and it works like a charm and fixes the warnings, but if possible I would prefer to pin to a version tag. Thank you!

scordio reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@runeflobakk runeflobakk mentioned this pull request Oct 13, 2026
Handle security hardening in Maven 3.10+ digipost/digipost-open-super-pom#15
Merged
4 of 19 tasks
@SorrowBlue SorrowBlue mentioned this pull request Oct 15, 2026
chore(deps): update actions/setup-java action to v6.1.0 SorrowBlue/ComicViewer#1488
Merged
1 task
@runeflobakk

runeflobakk commented Oct 16, 2026

Copy link
Copy Markdown

Thank you very much, @YunaBraska and @brunoborges (and the rest!) 🙌
https://github.com/actions/setup-java/releases/tag/v6.1.0

YunaBraska and brunoborges reacted with heart emoji
All reactions
  • ❤️ 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

This was referenced Oct 17, 2026
build: use setup-java Maven configuration YunaBraska/YunaBraska#93
Merged
build: use setup-java Maven configuration NanoNative/NanoNative#8
Merged
rvullriede added a commit to osslabz/github-actions that referenced this pull request Oct 23, 2026
@rvullriede
ci: declare Central's origin through setup-java
2261fc2
setup-java v6.1.0 ships mvn-server-repository-origins (actions/setup-java#1282),
which replaces the settings.xml patch both workflows carried.
rvullriede added a commit to peekaboot-org/peekaboot that referenced this pull request Oct 24, 2026
@rvullriede
ci: declare the server origin through setup-java
68a6282
v6.1.0 ships mvn-server-repository-origins (actions/setup-java#1282),
which replaces the sed patch on settings.xml.
gregor-dietrich pushed a commit to gregor-dietrich/Midas that referenced this pull request Oct 24, 2026
Renovate Bot gregor
Update actions/setup-java action to v6.1.0 (#113)
c2f5957
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/setup-java](https://github.com/actions/setup-java) | action | minor | `v6.0.1` → `v6.1.0` |

---

### Release Notes

<details>
<summary>actions/setup-java</summary>

### [`v6.1.0`](https://github.com/actions/setup-java/releases/tag/v6.1.0)

[Compare Source](actions/setup-java@v6.0.1...v6.1.0)

##### What's Changed

- Preserve compound Liberica build versions from .sdkmanrc by [@&#8203;brunoborges](https://github.com/brunoborges) with [@&#8203;Copilot](https://github.com/Copilot) in [#&#8203;1268](actions/setup-java#1268)
- Support Temurin on Linux RISC-V by [@&#8203;yawkat](https://github.com/yawkat) in [#&#8203;1269](actions/setup-java#1269)
- Stop GPG agent before removing signature-verification home by [@&#8203;brunoborges](https://github.com/brunoborges) with [@&#8203;Copilot](https://github.com/Copilot) in [#&#8203;1273](actions/setup-java#1273)
- Prefer Zulu 4-segment hotfix builds when resolving version ranges by [@&#8203;brunoborges](https://github.com/brunoborges) in [#&#8203;1278](actions/setup-java#1278)
- Support Temurin JEP 322 patch versions like 26.0.2.1+1 by [@&#8203;brunoborges](https://github.com/brunoborges) in [#&#8203;1279](actions/setup-java#1279)
- chore(deps): bump undici from 6.28.0 to 6.29.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1274](actions/setup-java#1274)
- chore(deps): bump the monthly-npm-updates group with 13 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1276](actions/setup-java#1276)
- feat: support Maven server credential origins by [@&#8203;YunaBraska](https://github.com/YunaBraska) in [#&#8203;1282](actions/setup-java#1282)
- Support Maven plugin repositories in generated settings.xml by [@&#8203;brunoborges](https://github.com/brunoborges) in [#&#8203;1286](actions/setup-java#1286)

##### New Contributors

- [@&#8203;yawkat](https://github.com/yawkat) made their first contribution in [#&#8203;1269](actions/setup-java#1269)
- [@&#8203;YunaBraska](https://github.com/YunaBraska) made their first contribution in [#&#8203;1282](actions/setup-java#1282)

**Full Changelog**: <actions/setup-java@v6.0.1...v6.1.0>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: https://git.vptr.de/gregor/midas2/pulls/113
Reviewed-by: gregor <[email protected]>
Co-authored-by: Renovate Bot <[email protected]>
This was referenced Oct 26, 2026
Deploy: credentials for central.sonatype.com with Maven 3.10 eclipse-osgi-technology/.github#63
Merged
Deploy: credential origins of setup-java instead of credentialScope=id osgi/.github#16
Merged
@infeo infeo mentioned this pull request Nov 3, 2026
update to maven 3.10.0, cryptomator/siv-mode#107
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@YunaBraska @runeflobakk @brunoborges
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.