Skip to content

Add environment variables to resolve dependencies during releases #2289

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryanjbaxter merged 1 commit into from
Aug 11, 2026
+54 −0
Merged

Add environment variables to resolve dependencies during releases #2289

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .github/workflows/composites/env-variables/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,3 +40,30 @@ runs:
echo "MAVEN_SETTINGS=" >> $GITHUB_ENV
echo "Maven settings: none found, using Maven defaults"
fi

# Artifactory credentials for the settings file selected above.
#
# release-ci-settings.xml resolves its <server> entries from
# ${env.COMMERCIAL_ARTIFACTORY_USERNAME} / ${env.COMMERCIAL_ARTIFACTORY_PASSWORD},
# so those must exist in the environment or every request to commercial
# Artifactory is unauthenticated and fails with a 401.
#
# PASSWORD/USERNAME are the read-write commercial secrets and are empty on pull
# requests (and in OSS repos, where the secrets do not exist), in which case the
# read-only secrets are used instead. Resolving dependencies only needs read
# access, so a PR build still works.
if [[ -z $PASSWORD ]]; then
echo "COMMERCIAL_ARTIFACTORY_PASSWORD is not set, using the read only secret"
echo "COMMERCIAL_ARTIFACTORY_PASSWORD=${RO_PASSWORD}" >> $GITHUB_ENV
else
echo "COMMERCIAL_ARTIFACTORY_PASSWORD is set"
echo "COMMERCIAL_ARTIFACTORY_PASSWORD=${PASSWORD}" >> $GITHUB_ENV
fi

if [[ -z $USERNAME ]]; then
echo "COMMERCIAL_ARTIFACTORY_USERNAME is not set, using the read only secret"
echo "COMMERCIAL_ARTIFACTORY_USERNAME=${RO_USERNAME}" >> $GITHUB_ENV
else
echo "COMMERCIAL_ARTIFACTORY_USERNAME is set"
echo "COMMERCIAL_ARTIFACTORY_USERNAME=${USERNAME}" >> $GITHUB_ENV
fi
27 changes: 27 additions & 0 deletions .github/workflows/maven.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,15 @@ jobs:
echo "branch_safe=${SANITIZED_BRANCH}" >> $GITHUB_OUTPUT

- name: set env variables
env:
# Read-write commercial credentials, deliberately blank on pull requests so that
# forked PRs fall back to the read-only secrets. The composite picks whichever
# pair is populated and exports COMMERCIAL_ARTIFACTORY_USERNAME/PASSWORD, which
# release-ci-settings.xml interpolates to reach commercial Artifactory.
PASSWORD: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || '' }}
USERNAME: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || '' }}
RO_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_RO_PASSWORD }}
RO_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_RO_USERNAME }}
uses: ./.github/workflows/composites/env-variables

- name: setup project jdk
Expand Down Expand Up @@ -174,6 +183,15 @@ jobs:
uses: ./.github/workflows/composites/clean-space

- name: set env variables
env:
# Read-write commercial credentials, deliberately blank on pull requests so that
# forked PRs fall back to the read-only secrets. The composite picks whichever
# pair is populated and exports COMMERCIAL_ARTIFACTORY_USERNAME/PASSWORD, which
# release-ci-settings.xml interpolates to reach commercial Artifactory.
PASSWORD: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || '' }}
USERNAME: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || '' }}
RO_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_RO_PASSWORD }}
RO_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_RO_USERNAME }}
uses: ./.github/workflows/composites/env-variables

- name: setup project jdk
Expand Down Expand Up @@ -232,6 +250,15 @@ jobs:
uses: ./.github/workflows/composites/clean-space

- name: set env variables
env:
# Read-write commercial credentials, deliberately blank on pull requests so that
# forked PRs fall back to the read-only secrets. The composite picks whichever
# pair is populated and exports COMMERCIAL_ARTIFACTORY_USERNAME/PASSWORD, which
# release-ci-settings.xml interpolates to reach commercial Artifactory.
PASSWORD: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || '' }}
USERNAME: ${{ github.event_name != 'pull_request' && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || '' }}
RO_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_RO_PASSWORD }}
RO_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_RO_USERNAME }}
uses: ./.github/workflows/composites/env-variables

- name: setup project jdk
Expand Down
Loading