Question

Your team publishes internal Java libraries to GitHub Packages in the org repository 'contoso/shared-libs'. A separate build project in another repository must consume these Maven packages during its GitHub Actions build. The build fails with a 401 Unauthorized when Maven attempts to download the dependency. You need the consuming workflow to authenticate to the GitHub Packages Maven registry with the least privilege necessary. What should you configure?

Accepted Answer

Add a server entry in settings.xml that uses the GITHUB_TOKEN provided to the workflow, and ensure the job has 'packages: read' permission.

Answer

Store a classic personal access token with 'repo' and 'write:packages' scopes as a repository secret and reference it in settings.xml.

Answer

Configure an OIDC federated credential between GitHub Actions and GitHub Packages so no token is required.

Answer

Make the 'contoso/shared-libs' repository public so the Maven registry no longer requires authentication.