GitHub package registry as Maven repo - trouble uploading artifact

I noticed that I was able to deploy to the github registry on my laptop, so I looked at the maven versions used.  The ubuntu-latest runner is using 3.6.1, and I was pretty far behind at 3.0.5.  The earliest    Looking at the maven version on ubuntu-latest in github actions, I was pretty far behind at 3.0.5   After verifying that I coud reproduce using the 3.6.1 maven container, I found the oldest published version on docker hub, and replaced my 

mvn deploy


docker run --rm -v $HOME/.m2:/root/.m2 \
        -v $(pwd):/work -w /work \
        maven:3.3.1-jdk-8 mvn deploy

I’m curious to figure out which version of maven it becomes incompatible, but not curious enough to do the work :slight_smile:

Just a small update,  I can now publish jars with classifiers, using mvn deploy - by turning off the wagon http pool. 

mvn -B -e -Dmaven.wagon.http.pool=false clean deploy


Here’re some fixes which worked for us (multimodule pom). This is mostly the summary of this thread:

  • Disable pooling: -Dmaven.wagon.http.pool=false

  • Switch to maven deploy plugin 3.0.0-M1 which isn’t failing the build, when it’s not able to upload maven-metadata.xml (<-- maybe we can skip the pooling switch. Didn’t try that out anymore)

  • Add scm url with org and common prefix in order to group multiple packages (use the same url as in distributionManagement). This project is a multi-module one, so we do need that:
  • Use personal access token in settings.xml (username=your github account, password=token)

Not of all of this might be necessary, but it’s at least working correctly for us for now. It just might help you to solve your issues. 

Full sample parent pom available at

Project available at


Do you know if this is something being worked on? Snapshots are supposed to be mutable :confused:


I’m trying to deploy an artifact to GitHub package registry. Is has nothing special on it it’s just a library class ( that i need as a dependency to my other projects.

I’ve followed the guide in, with no success.

Can someone explain how can I deploy an artifact during my workflow. Just to check, I need to have:

     <name>GitHub OWNER Apache Maven Packages</name>

on my pom.xml, did that got a 401. What I’m I missing.

A simple hellow world artifact repository example would be a great starting point for everyone i guess.


1 Like

Thanks for this. Only this was working for me from inside a github action. When running mvn deploy it always gave me 401, while it perfectly worked with the same user/token locally and even on TravisCI.

It’s Feb 2020 I am still facing the same issue. Not sure why Github hasn’t fixed the issue


I am not sure what the problem is, but this works:

name: Java CI

on: [push]


    runs-on: ubuntu-latest

    - uses: actions/checkout@v2
    - name: Set up JDK 1.8
      uses: actions/setup-java@v1
        java-version: 1.8
    - name: Deploy to Github Package Registry
        GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
      run: |
        mkdir -p ~/.m2
        echo "<settings><servers><server><id>github</id><username>USER</username><password>${GITHUB_TOKEN}</password></server></servers></settings>" > ~/.m2/settings.xml
        mvn deploy -DaltDeploymentRepository=github::default::

Alternatively, instead of specifying altDeploymentRepository you can also have a DistributionManagement entry in the pom file. In this case mvn deploy should be enough.

What I don’t understand is, how GitHub presents a command on the packages page that just does not work.


I also have the issue, tried the latest maven-deploy-plugin version, disabled pooling but the problem persists.

First snapshot deployment apparently works:

[INFO] --- maven-deploy-plugin:3.0.0-M1:deploy (default-deploy) @ commons ---
Downloading from snapshots:
Uploading to snapshots:
Uploaded to snapshots: (14 kB at 3.7 kB/s)
Uploading to snapshots:
Uploaded to snapshots: (2.1 kB at 864 B/s)
Uploading to snapshots:
Uploaded to snapshots: (431 kB at 88 kB/s)
Downloading from snapshots:
Downloaded from snapshots: (232 B at 283 B/s)
Uploading to snapshots:
Uploaded to snapshots: (980 B at 564 B/s)
Uploading to snapshots:
Uploaded to snapshots: (312 B at 190 B/s)
[INFO] ------------------------------------------------------------------------
[INFO] ------------------------------------------------------------------------

but the repository is left in a bad state, failing (HTTP 400) to return maven-metadata.xml

error retrieving metadata for snapshot file: commons-0.0.0-20200322.104140-1-javadoc.jar

Making following deployments fail.

The error code (400, Bad request) makes no sense to me, since i am able to fetch other non-snapshot maven-metada.xml files the same way.

I would appreciate some feedback from the GitHub stuff, looks like the repository implementation is failing for some reason


Avoiding attaching the -javadoc.jar made it work.

I’m seeing exactly the same thing as @idelvall - first snapshot deployment works, second fails with a 400.

1 Like

And for me a Maven pom parent project work with SNAPSHOT and a Maven jar project didn’t ?!

In my case renaming the product config project name *.workbench.ide.product intersecting with the bundle name *.workbench.ide solved problem.

Unfortunately after the next deploy build failed with the same error 400.

What helped for me was to turn on stack traces e.g 

mvn -f pom.xml --settings settings.xml clean compile -X

i could then see the reason for the bad request

[DEBUG] Failed to decrypt password for server github: org.sonatype.plexus.components.sec.dispatcher.SecDispatcherException: /home/runner/.m2/settings-security.xml (No such file or directory) /home/runner/.m2/settings-security.xml (No such file or directory)

Authentication failed for

I have exact the same problem, deploy with classifiers genarates a corrupted maven-metadata.xml in the SNAPSHOT-Version-folder at GitHub Packages. So if i try to fetch the file (maven-metadata.xml) over my browser after the first deployment (which succeeds by the way)  i get http status 400 with the additional info that the metadata for my artifact with classifier couldn not be found (error retrieving metadata for snapshot file: xy). The aritfacts are available, but the metadata file seems to be corrupted.  this fact prevents all further deployments with the same SNAPSHOT-Version. sounds as a bug for me… Deactivating pooling (-Dmaven.wagon.http.pool=false), new version of the maven-deploy-plugin, using PAT instead of GitHub Token - nothing helped.


Thank you so much you save me @eissymont . I got the same problem you described. I am able to deploy packages on Github, but can’t use it as a dependency in other maven projects, which keep warning: Could not transfer metadata <my package>/maven-metadata.xml from/to github (<username>/<repo>): Transfer failed for<username>/<repo>/path/to/maven-metadata.xml 400 Bad Request
Ridiculously, if I deploy my package without SNAPSHOT on the version tag. Everything starts working fine.


Ridiculously, if I deploy my package without SNAPSHOT on the version tag. Everything starts working fine.

There is currently an issue open about using classifiers with SNAPSHOT versions. You can find more info in this thread:

You might find you can use a non-SNAPSHOT version combined with the Delete Package Versions action to get similar behaviour.

You’ll probably need to use the following command when restoring your non-SNAPSHOT versions locally:

mvn dependency:purge-local-repository

I hope that helps!