401 Unauthorized downloading a public package from GitHub Packages using Gradle - maven

Question

I am the maintainer of a public GitHub repo. I have set up GitHub Actions to build a publish to GitHub Packages. You can see the package has been created here:
https://github.com/paulschwarz/spring-dotenv/packages/135114
The first thing I notice is that GitHub only gives a Maven installation snippet. I used this code to add the dependency to another project and it appeared to work.
Now I want to import this package into a Gradle project. I added
dependencies {
implementation ('me.paulschwarz:spring-dotenv:0.0.3')
}
and gradle tells me
Could not find me.paulschwarz:spring-dotenv:0.0.3.
Searched in the following locations:
- https://jcenter.bintray.com/me/paulschwarz/spring-dotenv/0.0.3/spring-dotenv-0.0.3.pom
- https://repo.maven.apache.org/maven2/me/paulschwarz/spring-dotenv/0.0.3/spring-dotenv-0.0.3.pom
This is already strange because my Maven project appeared to have no problem resolving the dependency. I must say I'm curious how that worked? Surely GitHub Packages isn't integrated with JCenter or Maven Central?
Anyway, next step, add the repository
repositories {
jcenter()
mavenCentral()
maven { url = uri('https://maven.pkg.github.com/paulschwarz/spring-dotenv') }
}
At this point, Gradle should understand where to find the package. However, I get this
> Could not resolve me.paulschwarz:spring-dotenv:0.0.3.
> Could not get resource 'https://maven.pkg.github.com/paulschwarz/spring-dotenv/me/paulschwarz/spring-dotenv/0.0.3/spring-dotenv-0.0.3.pom'.
> Could not GET 'https://maven.pkg.github.com/paulschwarz/spring-dotenv/me/paulschwarz/spring-dotenv/0.0.3/spring-dotenv-0.0.3.pom'. Received status code 401 from server: Unauthorized
Is this really a 401 unauthorized? or is the URL wrong and it's trying to hit an authorized endpoint?
If it's genuine, then why? This is a public repo with public packages. I can download the package directly from the GitHub page anonymously. What am I doing wrong in Gradle?

Answer 1

As you have observed, GitHub doesn't support unauthorized package access right now (but planned in future) as explained by one of their staff (May 27 '20):
Our Maven service doesn’t allow for unauthorized access right now. We plan to offer this in the future but need to improve the service a bit before that.
For Actions you can add a PAT to your secrets store or use the GITHUB_TOKEN to authenticate. In your settings.xml we suggest using the environment variable approach (see setup-java 4) so you don’t store the tokens in the file.

Answer 2

As mentioned above you need to authenticate to GitHub Packages.
ext {
GITHUB_TOKEN = System.getenv("GITHUB_TOKEN")
}
maven {
url "https://maven.pkg.github.com/paulschwarz/spring-dotenv"
credentials {
username GITHUB_USER
password GITHUB_TOKEN
}
}
Where GITHUB_USER is defined in your gradle.properties and GITHUB_TOKEN is defined as an environment variable. GITHUB_TOKEN is available inside your GitHub Actions workflow file as ${{ secrets.GITHUB_TOKEN }}
You will have to define it yourself when running locally.

Answer 3

In my case, I'm using Maven. After researching around, ended up that I need to generate a GitHub token instead of using the plain GitHub user login password one.