Repository navigation
Test: read Maven packages from other repositories (do not merge) - #4
Closed
venkata-kishore wants to merge 2 commits into
Closed
venkata-kishore wants to merge 2 commits into
venkata-kishore wants to merge 2 commits into
Conversation
Member
Author
|
Test done: GITHUB_TOKEN downloads public Maven packages from other repositories with and without packages: read (200 after a redirect to the registry file store), the BonfireTrunk/* URL works, and a missing version returns 404. |
venkata-kishore
added a commit
that referenced
this pull request
Oct 30, 2026
… snapshots from prime (#5) Makes GitHub Packages a fallback for BonfireTrunk's own artifacts, so a library's pull request can build against another library's snapshot, published on request, or a release Central has not accepted yet, without spending a Maven Central release. **Pull request builds (`maven-build.yml`)** - **Search order.** Before building, the workflow writes a settings file that lists Maven Central first and `https://maven.pkg.github.com/<owner>/*` second. Repositories in settings are searched before the POM's, so Central stays the source for everything it has. - **Scope.** A resolver groupId filter limits GitHub Packages to `today.bonfire.oss`. No other artifact can come from it. - **Snapshots.** They are re-checked on every build (`updatePolicy always`), so a new snapshot is picked up even from a restored Maven cache. - **Auth.** It uses the workflow's own `GITHUB_TOKEN`, so no secret is needed and library `build.yml` files don't change. - **Graceful fallback.** A repo that can't reach GitHub Packages behaves exactly as before: it fails only when a dependency isn't on Central. **Release workflow (`maven-release.yml`)** - **New `snapshot` job, opt-in.** It runs only when the squash title of a merge into `prime` starts with `Snapshot:`, for example `Snapshot: Add a borrow timeout`, the same way a release needs `Release X.Y.Z`. GitHub matches the prefix without regard to case. It runs `verify deploy:deploy` to GitHub Packages with the library's `maven-args`, resolving like the PR build, and is not signed. If the pom version is not a `-SNAPSHOT`, it fails with an error, because the title asked for a snapshot. Other merges publish nothing and still show as skipped runs, so routine merges don't add snapshot builds. Callers already grant `packages: write`, so no caller change is needed. - **The `release` job still resolves from Central only.** Its check step now also runs `enforcer:enforce -Denforcer.rules=requireReleaseDeps`. That fails early, with a clear error, on any SNAPSHOT dependency or SNAPSHOT parent. **README**: a "GitHub Packages as a fallback" section, an updated table, and how to use snapshots locally with a classic token that has `read:packages`. **Tested** - **Token.** A throwaway workflow (#4, closed) showed that `GITHUB_TOKEN` downloads public Maven packages published from other repositories in the organization. That held with and without `packages: read`, and through the `BonfireTrunk/*` URL: 200 after a redirect to the registry file store, real POM content. A missing version returns 404. - **Search order and filter, locally**, with the same settings and filter flags on the wrapper's Maven 3.10.0 (Resolver 2.0.24): - A `today.bonfire.oss` artifact that is on Central came from Central, with no GitHub request. - A missing one tried Central, then GitHub. - A third-party artifact never touched GitHub. - **Central-only guard, locally.** A release-style, Central-only build refuses an artifact that an earlier build cached from `github` ("cached from a remote repository ID that is unavailable in current build context") and fails when Central lacks it. A release cannot pick up a GitHub-only artifact from a shared Maven cache. - **SNAPSHOT check, locally.** `requireReleaseDeps` passes with release dependencies. It fails on a SNAPSHOT dependency ("is not a release dependency") and on a SNAPSHOT parent ("Parent Cannot be a snapshot"). - **On GitHub, via a throwaway caller PR** (closed): - The PR build through `maven-build.yml@github-packages-fallback` succeeded. - A manual release run through `maven-release.yml@github-packages-fallback` parsed the new file, and both jobs skipped as designed. - **Not run yet.** The `snapshot` job itself only runs on a push to `prime`, so its first real run will be the first `Snapshot:` merge after this lands. The parse check above ran before the job became opt-in; that later change touches only its `if` and its non-SNAPSHOT message. actionlint was not run on this change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Throwaway test. Checks whether a workflow's GITHUB_TOKEN can download Maven packages that were published from other BonfireTrunk repositories, with and without
packages: read, including theBonfireTrunk/*URL form. It will be closed and its branch deleted.