Repositories to resolve Maven artifacts from seem to be tampered with

[sschuberth]

Description:

In our tests that we run in GitHub actions that use setup-java we verify the full URLs where artifacts in Maven / Gradle test projects have been resolved from (as our project is about dependency analysis).

With a recent change that fixes the order of Maven repositories to search for artifacts on our side, we realized that the new expected test results fail on GitHub actions while the same tests pass locally (tested on Windows, Linux, Docker).

So it seems that it's probably setup-java that's somehow tampering with Maven artifact resolution. As a Maven settings.xml takes precedence over repositories declared in POMs, I added a commit to my PR that should avoid setup-java to write a settings.xml, but the issue remains.

Task version:

actions/setup-java@v3

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:

See the GradleKotlinScriptFunTest and SbtFunTest test failures in https://github.com/oss-review-toolkit/ort/actions/runs/4196901639/jobs/7278510514.

Expected behavior:

All dependencies for the Gradle test project used by GradleKotlinScriptFunTest should be resolved from JCenter.

Actual behavior:

Only on GitHub actions with setup-java, dependencies are resolved from Maven Central instead of JCenter, e.g from

https://repo.maven.apache.org/maven2/org/jetbrains/annotations/13.0/annotations-13.0.jar

instead of the expected

https://jcenter.bintray.com/org/jetbrains/annotations/13.0/annotations-13.0.jar

[IvanZosimov]

Hi, @sschuberth, thank for the issue, we will take a look at it and get back to you with updates.

[sschuberth]

I'm pretty certain by now that it's not (only) setup-java's fault, as I cannot reproduce the issue with a small test project that I created who's Gradle build scan proves that artifacts were resolved from JCenter. Also, when running GradleKotlinScriptFunTest in our original project outside of Docker, the test passes. I'll do some more test to double-check and will eventually close this issue.

[sschuberth]

I'm now confident that the issue is not with setup-java, sorry for the noise!

[IvanZosimov]

@sschuberth, thanks for your feedback ❤️