Add multiple Maven server credentials (#1239)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: brunoborges

README.md

@@ -170,6 +170,7 @@ steps:
 | `server-id` | Maven repository ID used in generated `settings.xml`. | `github` |
 | `server-username-env-var` | Environment variable name for Maven repository username. | `GITHUB_ACTOR` |
 | `server-password-env-var` | Environment variable name for Maven repository password or token. | `GITHUB_TOKEN` |
+| `mvn-server-credentials` | Multiline Maven server credentials in the format `server-id:USERNAME_ENV:PASSWORD_ENV`. Replaces the single server configured by the three inputs above when set. | |
 | `settings-path` | Directory where `settings.xml` is written. | `~/.m2` |
 | `overwrite-settings` | Overwrite an existing `settings.xml`. | `true` |
 | `gpg-private-key` | GPG private key to import into an isolated temporary keyring. | |

__tests__/auth.test.ts

@@ -26,7 +26,7 @@ jest.unstable_mockModule('@actions/core', () => ({
   setOutput: jest.fn(),
   getInput: jest.fn(),
   getBooleanInput: jest.fn(),
-  getMultilineInput: jest.fn(),
+  getMultilineInput: jest.fn(() => []),
   addPath: jest.fn(),
   exportVariable: jest.fn(),
   saveState: jest.fn(),
@@ -57,6 +57,9 @@ const {M2_DIR, MVN_SETTINGS_FILE, STATE_GPG_HOME} =
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const m2Dir = path.join(__dirname, M2_DIR);
 const settingsFile = path.join(m2Dir, MVN_SETTINGS_FILE);
+const credentials = (id: string, username: string, password: string) => [
+  {id, usernameEnvVar: username, passwordEnvVar: password}
+];
 
 describe('auth tests', () => {
   let spyOSHomedir: any;
@@ -73,6 +76,9 @@ describe('auth tests', () => {
 
   afterEach(() => {
     (core.getInput as jest.Mock).mockReset();
+    (core.getMultilineInput as jest.Mock).mockReset();
+    (core.getMultilineInput as jest.Mock).mockReturnValue([]);
+    (core.warning as jest.Mock).mockReset();
     (core.exportVariable as jest.Mock).mockReset();
     (gpg.importKey as jest.Mock).mockReset();
     (gpg.removeGpgHome as jest.Mock).mockReset();
@@ -100,9 +106,7 @@ describe('auth tests', () => {
     await io.rmRF(altHome); // ensure it doesn't already exist
 
     await auth.createAuthenticationSettings(
-      id,
-      username,
-      password,
+      credentials(id, username, password),
       altHome,
       true
     );
@@ -113,7 +117,7 @@ describe('auth tests', () => {
     expect(fs.existsSync(altHome)).toBe(true);
     expect(fs.existsSync(altSettingsFile)).toBe(true);
     expect(fs.readFileSync(altSettingsFile, 'utf-8')).toEqual(
-      auth.generate(id, username, password)
+      auth.generate(credentials(id, username, password))
     );
 
     await io.rmRF(altHome);
@@ -125,17 +129,15 @@ describe('auth tests', () => {
     const password = 'TOKEN';
 
     await auth.createAuthenticationSettings(
-      id,
-      username,
-      password,
+      credentials(id, username, password),
       m2Dir,
       true
     );
 
     expect(fs.existsSync(m2Dir)).toBe(true);
     expect(fs.existsSync(settingsFile)).toBe(true);
     expect(fs.readFileSync(settingsFile, 'utf-8')).toEqual(
-      auth.generate(id, username, password)
+      auth.generate(credentials(id, username, password))
     );
   }, 100000);
 
@@ -146,9 +148,7 @@ describe('auth tests', () => {
     const gpgPassphrase = 'GPG';
 
     await auth.createAuthenticationSettings(
-      id,
-      username,
-      password,
+      credentials(id, username, password),
       m2Dir,
       true,
       gpgPassphrase
@@ -157,7 +157,7 @@ describe('auth tests', () => {
     expect(fs.existsSync(m2Dir)).toBe(true);
     expect(fs.existsSync(settingsFile)).toBe(true);
     expect(fs.readFileSync(settingsFile, 'utf-8')).toEqual(
-      auth.generate(id, username, password, gpgPassphrase)
+      auth.generate(credentials(id, username, password), gpgPassphrase)
     );
   }, 100000);
 
@@ -218,17 +218,15 @@ describe('auth tests', () => {
     expect(fs.existsSync(settingsFile)).toBe(true);
 
     await auth.createAuthenticationSettings(
-      id,
-      username,
-      password,
+      credentials(id, username, password),
       m2Dir,
       true
     );
 
     expect(fs.existsSync(m2Dir)).toBe(true);
     expect(fs.existsSync(settingsFile)).toBe(true);
     expect(fs.readFileSync(settingsFile, 'utf-8')).toEqual(
-      auth.generate(id, username, password)
+      auth.generate(credentials(id, username, password))
     );
   }, 100000);
 
@@ -243,9 +241,7 @@ describe('auth tests', () => {
     expect(fs.existsSync(settingsFile)).toBe(true);
 
     await auth.createAuthenticationSettings(
-      id,
-      username,
-      password,
+      credentials(id, username, password),
       m2Dir,
       false
     );
@@ -273,7 +269,9 @@ describe('auth tests', () => {
   </servers>
 </settings>`;
 
-    expect(auth.generate(id, username, password)).toEqual(expectedSettings);
+    expect(auth.generate(credentials(id, username, password))).toEqual(
+      expectedSettings
+    );
   });
 
   it('generates valid settings.xml with additional configuration', () => {
@@ -306,9 +304,9 @@ describe('auth tests', () => {
   </activeProfiles>
 </settings>`;
 
-    expect(auth.generate(id, username, password, gpgPassphrase)).toEqual(
-      expectedSettings
-    );
+    expect(
+      auth.generate(credentials(id, username, password), gpgPassphrase)
+    ).toEqual(expectedSettings);
   });
 
   it('does not add a gpg profile when the passphrase env var is the maven-gpg-plugin default', () => {
@@ -330,9 +328,9 @@ describe('auth tests', () => {
   </servers>
 </settings>`;
 
-    expect(auth.generate(id, username, password, gpgPassphrase)).toEqual(
-      expectedSettings
-    );
+    expect(
+      auth.generate(credentials(id, username, password), gpgPassphrase)
+    ).toEqual(expectedSettings);
   });
 
   it('escapes settings.xml values while preserving parsed semantics', () => {
@@ -341,7 +339,10 @@ describe('auth tests', () => {
     const password = `TOKEN&<>"'é`;
     const gpgPassphrase = `GPG&<>"'é`;
 
-    const xml = auth.generate(id, username, password, gpgPassphrase);
+    const xml = auth.generate(
+      credentials(id, username, password),
+      gpgPassphrase
+    );
     const parsed = parseXmlObject(xml) as any;
 
     expect(parsed.settings.interactiveMode).toBe('false');
@@ -352,6 +353,144 @@ describe('auth tests', () => {
     expect(parsed.settings.activeProfiles.activeProfile).toBe('setup-java-gpg');
   });
 
+  it('generates ordered settings.xml entries for multiple servers', () => {
+    const servers = [
+      {
+        id: 'releases',
+        usernameEnvVar: 'RELEASES_USERNAME',
+        passwordEnvVar: 'RELEASES_PASSWORD'
+      },
+      {
+        id: 'snapshots',
+        usernameEnvVar: 'SNAPSHOTS_USERNAME',
+        passwordEnvVar: 'SNAPSHOTS_PASSWORD'
+      }
+    ];
+
+    const parsed = parseXmlObject(auth.generate(servers)) as any;
+
+    expect(parsed.settings.servers.server).toEqual([
+      {
+        id: 'releases',
+        username: '${env.RELEASES_USERNAME}',
+        password: '${env.RELEASES_PASSWORD}'
+      },
+      {
+        id: 'snapshots',
+        username: '${env.SNAPSHOTS_USERNAME}',
+        password: '${env.SNAPSHOTS_PASSWORD}'
+      }
+    ]);
+  });
+
+  it('parses and trims multiline Maven server credentials', () => {
+    expect(
+      auth.parseMavenServerCredentials([
+        '',
+        ' releases : RELEASES_USERNAME : RELEASES_PASSWORD ',
+        'snapshots:SNAPSHOTS_USERNAME:SNAPSHOTS_PASSWORD'
+      ])
+    ).toEqual([
+      {
+        id: 'releases',
+        usernameEnvVar: 'RELEASES_USERNAME',
+        passwordEnvVar: 'RELEASES_PASSWORD'
+      },
+      {
+        id: 'snapshots',
+        usernameEnvVar: 'SNAPSHOTS_USERNAME',
+        passwordEnvVar: 'SNAPSHOTS_PASSWORD'
+      }
+    ]);
+  });
+
+  it.each([
+    {
+      entries: ['releases:RELEASES_USERNAME'],
+      error:
+        'Invalid mvn-server-credentials entry at line 1. Expected format: server-id:USERNAME_ENV:PASSWORD_ENV'
+    },
+    {
+      entries: ['', 'releases:RELEASES_USERNAME:RELEASES_PASSWORD:EXTRA'],
+      error:
+        'Invalid mvn-server-credentials entry at line 2. Expected format: server-id:USERNAME_ENV:PASSWORD_ENV'
+    },
+    {
+      entries: ['releases::RELEASES_PASSWORD'],
+      error:
+        'Invalid mvn-server-credentials entry at line 1. server-id, username environment variable, and password environment variable are required'
+    }
+  ])(
+    'rejects malformed Maven server credentials: $entries',
+    ({entries, error}) => {
+      expect(() => auth.parseMavenServerCredentials(entries)).toThrow(error);
+    }
+  );
+
+  it('rejects duplicate Maven server ids', () => {
+    expect(() =>
+      auth.parseMavenServerCredentials([
+        'releases:RELEASES_USERNAME:RELEASES_PASSWORD',
+        'releases:OTHER_USERNAME:OTHER_PASSWORD'
+      ])
+    ).toThrow("Duplicate server-id 'releases' in mvn-server-credentials input");
+  });
+
+  it('uses multiline Maven server credentials instead of single-server inputs', () => {
+    (core.getMultilineInput as jest.Mock).mockReturnValue([
+      'releases:RELEASES_USERNAME:RELEASES_PASSWORD',
+      'snapshots:SNAPSHOTS_USERNAME:SNAPSHOTS_PASSWORD'
+    ]);
+
+    expect(auth.getMavenServerSettings()).toEqual([
+      {
+        id: 'releases',
+        usernameEnvVar: 'RELEASES_USERNAME',
+        passwordEnvVar: 'RELEASES_PASSWORD'
+      },
+      {
+        id: 'snapshots',
+        usernameEnvVar: 'SNAPSHOTS_USERNAME',
+        passwordEnvVar: 'SNAPSHOTS_PASSWORD'
+      }
+    ]);
+    expect(core.getInput).not.toHaveBeenCalled();
+  });
+
+  it('uses the existing single-server inputs when multiline credentials are absent', () => {
+    (core.getInput as jest.Mock).mockImplementation((name: string) =>
+      name === 'server-id' ? 'github' : ''
+    );
+
+    expect(auth.getMavenServerSettings()).toEqual([
+      {
+        id: 'github',
+        usernameEnvVar: 'GITHUB_ACTOR',
+        passwordEnvVar: 'GITHUB_TOKEN'
+      }
+    ]);
+  });
+
+  it('preserves deprecated single-server aliases as fallback inputs', () => {
+    (core.getInput as jest.Mock).mockImplementation((name: string) => {
+      const inputs: Record<string, string> = {
+        'server-id': 'legacy',
+        'server-username': 'LEGACY_USERNAME',
+        'server-password': 'LEGACY_PASSWORD'
+      };
+      return inputs[name] ?? '';
+    });
+
+    expect(auth.getMavenServerSettings()).toEqual([
+      {
+        id: 'legacy',
+        usernameEnvVar: 'LEGACY_USERNAME',
+        passwordEnvVar: 'LEGACY_PASSWORD'
+      }
+    ]);
+    expect(core.warning).toHaveBeenCalledTimes(2);
+  });
+
   function xmlElementText(xml: string, tagName: string): string {
     const match = new RegExp(`<${tagName}>([\\s\\S]*?)</${tagName}>`).exec(xml);
     expect(match).not.toBeNull();

action.yml

@@ -64,6 +64,9 @@ inputs:
   server-password:
     description: 'Deprecated alias for server-password-env-var'
     required: false
+  mvn-server-credentials:
+    description: 'Multiline list of Maven server credentials in the format `server-id:USERNAME_ENV:PASSWORD_ENV`. When set, replaces the single server configured by server-id, server-username-env-var, and server-password-env-var.'
+    required: false
   settings-path:
     description: 'Path to where the settings.xml file will be written. Default is ~/.m2.'
     required: false

dist/cleanup/index.js

@@ -30774,7 +30774,7 @@ module.exports = {
 /* harmony export */   gk: () => (/* binding */ INPUT_CACHE),
 /* harmony export */   wG: () => (/* binding */ INPUT_JOB_STATUS)
 /* harmony export */ });
-/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PRIVATE_KEY, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
+/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, INPUT_MVN_SERVER_CREDENTIALS, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PRIVATE_KEY, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
 const MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
 const INPUT_JAVA_VERSION = 'java-version';
 const INPUT_JAVA_VERSION_FILE = 'java-version-file';
@@ -30789,6 +30789,7 @@ const INPUT_SET_DEFAULT = 'set-default';
 const INPUT_PROBLEM_MATCHER = 'problem-matcher';
 const INPUT_VERIFY_SIGNATURE = 'verify-signature';
 const INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
+const INPUT_MVN_SERVER_CREDENTIALS = 'mvn-server-credentials';
 const INPUT_SERVER_ID = 'server-id';
 const INPUT_SERVER_USERNAME_ENV_VAR = 'server-username-env-var';
 const INPUT_SERVER_PASSWORD_ENV_VAR = 'server-password-env-var';