GitHub package registry as Maven repo - trouble uploading artifact

Writing to GitHub I have got the message that GitHub Package Registry currently does not support mutable packages, whether your package is SNAPSHOT or not. So the only way to update your package is to publish a new package.

Hope GPR supports mutable packags ASAP!


> Writing to GitHub I have got the message that GitHub Package Registry currently does not support mutable packages, whether your package is SNAPSHOT or not. So the only way to update your package is to publish a new package.

This is strange because the docs clearly state that you can deploy multiple packages (though I’m having the same problem - getting a 400 error after getting one deploy to work half-way).

You can deploy mutiple packages, but you cannot deploy mutable packages.

This means that you cannot publish a SNAPSHOT package again, such as publish a 1.0-SNAPSHOT package, and after updating something you cannot publish this package with version 1.0-SNAPSHOT again(This is strange for snapshot packages).

So the only way to update your package is to publish a new version of you package.


Thanks for your post, it was quite helpful. I noticed   mvn deploy fails on my end also, but like you rightly pointed, using deploy-file on one jar file works. Interestingly, you can only have one jar, seems any any attempt to upload multiple jars for a single deployment fails. This is a terrible experience, I spent most of my day troubleshooting this.

This does not work:

mvn deploy:deploy-file \
-DrepositoryId=github \
-Dfile=target/apigateway-feign-0.0.2-SNAPSHOT.M4.jar \
-Dsources=target/apigateway-feign-0.0.2-SNAPSHOT.M4-sources.jar \
-Djavadoc=target/apigateway-feign-0.0.2-SNAPSHOT.M4-javadoc.jar \
-Durl= \

However, this works:

mvn deploy:deploy-file \
-DrepositoryId=github \
-Dfile=target/apigateway-feign-0.0.2-SNAPSHOT.M6.jar \
-Durl= \

I noticed that I was able to deploy to the github registry on my laptop, so I looked at the maven versions used.  The ubuntu-latest runner is using 3.6.1, and I was pretty far behind at 3.0.5.  The earliest    Looking at the maven version on ubuntu-latest in github actions, I was pretty far behind at 3.0.5   After verifying that I coud reproduce using the 3.6.1 maven container, I found the oldest published version on docker hub, and replaced my 

mvn deploy


docker run --rm -v $HOME/.m2:/root/.m2 \
        -v $(pwd):/work -w /work \
        maven:3.3.1-jdk-8 mvn deploy

I’m curious to figure out which version of maven it becomes incompatible, but not curious enough to do the work :slight_smile:

Just a small update,  I can now publish jars with classifiers, using mvn deploy - by turning off the wagon http pool. 

mvn -B -e -Dmaven.wagon.http.pool=false clean deploy


Here’re some fixes which worked for us (multimodule pom). This is mostly the summary of this thread:

  • Disable pooling: -Dmaven.wagon.http.pool=false

  • Switch to maven deploy plugin 3.0.0-M1 which isn’t failing the build, when it’s not able to upload maven-metadata.xml (<-- maybe we can skip the pooling switch. Didn’t try that out anymore)

  • Add scm url with org and common prefix in order to group multiple packages (use the same url as in distributionManagement). This project is a multi-module one, so we do need that:
  • Use personal access token in settings.xml (username=your github account, password=token)

Not of all of this might be necessary, but it’s at least working correctly for us for now. It just might help you to solve your issues. 

Full sample parent pom available at

Project available at


Do you know if this is something being worked on? Snapshots are supposed to be mutable :confused:


I’m trying to deploy an artifact to GitHub package registry. Is has nothing special on it it’s just a library class ( that i need as a dependency to my other projects.

I’ve followed the guide in, with no success.

Can someone explain how can I deploy an artifact during my workflow. Just to check, I need to have:

     <name>GitHub OWNER Apache Maven Packages</name>

on my pom.xml, did that got a 401. What I’m I missing.

A simple hellow world artifact repository example would be a great starting point for everyone i guess.


1 Like

Thanks for this. Only this was working for me from inside a github action. When running mvn deploy it always gave me 401, while it perfectly worked with the same user/token locally and even on TravisCI.

It’s Feb 2020 I am still facing the same issue. Not sure why Github hasn’t fixed the issue


I am not sure what the problem is, but this works:

name: Java CI

on: [push]


    runs-on: ubuntu-latest

    - uses: actions/checkout@v2
    - name: Set up JDK 1.8
      uses: actions/setup-java@v1
        java-version: 1.8
    - name: Deploy to Github Package Registry
        GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
      run: |
        mkdir -p ~/.m2
        echo "<settings><servers><server><id>github</id><username>USER</username><password>${GITHUB_TOKEN}</password></server></servers></settings>" > ~/.m2/settings.xml
        mvn deploy -DaltDeploymentRepository=github::default::

Alternatively, instead of specifying altDeploymentRepository you can also have a DistributionManagement entry in the pom file. In this case mvn deploy should be enough.

What I don’t understand is, how GitHub presents a command on the packages page that just does not work.


I also have the issue, tried the latest maven-deploy-plugin version, disabled pooling but the problem persists.

First snapshot deployment apparently works:

[INFO] --- maven-deploy-plugin:3.0.0-M1:deploy (default-deploy) @ commons ---
Downloading from snapshots:
Uploading to snapshots:
Uploaded to snapshots: (14 kB at 3.7 kB/s)
Uploading to snapshots:
Uploaded to snapshots: (2.1 kB at 864 B/s)
Uploading to snapshots:
Uploaded to snapshots: (431 kB at 88 kB/s)
Downloading from snapshots:
Downloaded from snapshots: (232 B at 283 B/s)
Uploading to snapshots:
Uploaded to snapshots: (980 B at 564 B/s)
Uploading to snapshots:
Uploaded to snapshots: (312 B at 190 B/s)
[INFO] ------------------------------------------------------------------------
[INFO] ------------------------------------------------------------------------

but the repository is left in a bad state, failing (HTTP 400) to return maven-metadata.xml

error retrieving metadata for snapshot file: commons-0.0.0-20200322.104140-1-javadoc.jar

Making following deployments fail.

The error code (400, Bad request) makes no sense to me, since i am able to fetch other non-snapshot maven-metada.xml files the same way.

I would appreciate some feedback from the GitHub stuff, looks like the repository implementation is failing for some reason


Avoiding attaching the -javadoc.jar made it work.

I’m seeing exactly the same thing as @idelvall - first snapshot deployment works, second fails with a 400.

1 Like

And for me a Maven pom parent project work with SNAPSHOT and a Maven jar project didn’t ?!

In my case renaming the product config project name *.workbench.ide.product intersecting with the bundle name *.workbench.ide solved problem.

Unfortunately after the next deploy build failed with the same error 400.

What helped for me was to turn on stack traces e.g 

mvn -f pom.xml --settings settings.xml clean compile -X

i could then see the reason for the bad request

[DEBUG] Failed to decrypt password for server github: org.sonatype.plexus.components.sec.dispatcher.SecDispatcherException: /home/runner/.m2/settings-security.xml (No such file or directory) /home/runner/.m2/settings-security.xml (No such file or directory)

Authentication failed for

I have exact the same problem, deploy with classifiers genarates a corrupted maven-metadata.xml in the SNAPSHOT-Version-folder at GitHub Packages. So if i try to fetch the file (maven-metadata.xml) over my browser after the first deployment (which succeeds by the way)  i get http status 400 with the additional info that the metadata for my artifact with classifier couldn not be found (error retrieving metadata for snapshot file: xy). The aritfacts are available, but the metadata file seems to be corrupted.  this fact prevents all further deployments with the same SNAPSHOT-Version. sounds as a bug for me… Deactivating pooling (-Dmaven.wagon.http.pool=false), new version of the maven-deploy-plugin, using PAT instead of GitHub Token - nothing helped.