Authenticating to GitHub Packages

You need an access token to publish, install, and delete private, internal, and public packages.

You can use a personal access token (classic) to authenticate to GitHub Packages or the GitHub API. When you create a personal access token (classic), you can assign the token different scopes depending on your needs. For more information about packages-related scopes for a personal access token (classic), seeAbout permissions for GitHub Packages.

To authenticate to a GitHub Packages registry within a GitHub Actions workflow, you can use:

• GITHUB_TOKEN to publish packages associated with the workflow repository.
• A personal access token (classic) with at leastread:packages scope to install packages associated with other private repositories (GITHUB_TOKEN can be used if the repository is granted read access to the package. SeeConfiguring a package's access control and visibility).

For more information aboutGITHUB_TOKEN used in GitHub Actions workflows, seeUse GITHUB_TOKEN for authentication in workflows.

Authenticating with a personal access token

You must use a personal access token (classic) with the appropriate scopes to publish and install packages in GitHub Packages. For more information, seeIntroduction to GitHub Packages.

You can authenticate to GitHub Packages with Apache Maven by editing your~/.m2/settings.xml file to include your personal access token (classic). Create a new~/.m2/settings.xml file if one doesn't exist.

In theservers tag, add a childserver tag with anid, replacing USERNAME with your GitHub username, and TOKEN with your personal access token.

In therepositories tag, configure a repository by mapping theid of the repository to theid you added in theserver tag containing your credentials. Replace OWNER with the name of the personal account or organization that owns the repository. Because uppercase letters aren't supported, you must use lowercase letters for the repository owner even if the GitHub user or organization name contains uppercase letters.

If you want to interact with multiple repositories, you can add each repository to separaterepository children in therepositories tag, mapping theid of each to the credentials in theservers tag.

GitHub Packages supportsSNAPSHOT versions of Apache Maven. To use the GitHub Packages repository for downloadingSNAPSHOT artifacts, enable SNAPSHOTS in the POM of the consuming project or your~/.m2/settings.xml file.

<settingsxmlns="http://maven.apache.org/SETTINGS/1.0.0"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0                      http://maven.apache.org/xsd/settings-1.0.0.xsd"><activeProfiles><activeProfile>github</activeProfile></activeProfiles><profiles><profile><id>github</id><repositories><repository><id>central</id><url>https://repo.maven.apache.org/maven2</url></repository><repository><id>github</id><url>https://maven.pkg.github.com/OWNER/REPOSITORY</url><snapshots><enabled>true</enabled></snapshots></repository></repositories></profile></profiles><servers><server><id>github</id><username>USERNAME</username><password>TOKEN</password></server></servers></settings>

Publishing a package

By default, GitHub publishes the package to an existing repository with the same name as the package. For example, GitHub will publish a package namedcom.example:test in a repository calledOWNER/test.

If you would like to publish multiple packages to the same repository, you can include the URL of the repository in the<distributionManagement> element of thepom.xml file. GitHub will match the repository based on that field. Since the repository name is also part of thedistributionManagement element, there are no additional steps to publish multiple packages to the same repository.

For more information on creating a package, see themaven.apache.org documentation.

1. Edit thedistributionManagement element of thepom.xml file located in your package directory, replacingOWNER with the name of the personal account or organization that owns the repository andREPOSITORY with the name of the repository containing your project.

   <distributionManagement><repository><id>github</id><name>GitHub OWNER Apache Maven Packages</name><url>https://maven.pkg.github.com/OWNER/REPOSITORY</url></repository></distributionManagement>

2. Publish the package.

   mvn deploy

After you publish a package, you can view the package on GitHub. For more information, seeViewing packages.

Installing a package

To install an Apache Maven package from GitHub Packages, edit thepom.xml file to include the package as a dependency. If you want to install packages from any repository for a specified repository owner, use a repository URL likehttps://maven.pkg.github.com/OWNER/*. For more information on using apom.xml file in your project, seeIntroduction to the POM in the Apache Maven documentation.

1. Authenticate to GitHub Packages. For more information, seeAuthenticating to GitHub Packages.

2. Add the package dependencies to thedependencies element of your projectpom.xml file, replacingcom.example:test with your package.

   <dependencies><dependency><groupId>com.example</groupId><artifactId>test</artifactId><version>1.0.0-SNAPSHOT</version></dependency></dependencies>

3. Install the package.

   mvn install

Further reading

• Working with the Gradle registry
• Deleting and restoring a package