Access to GitHub Packages in the plugin

[olavtar]

Service(s)

ci.jenkins.io, GitHub, plugins.jenkins.io

Summary

We use dependencies that are hosted on GitHub Packages in our plugin.
Access to GitHub Packages works only through a personal access token

Our plugin: https://github.com/jenkinsci/redhat-dependency-analytics-plugin

We would like https://github.com/jenkinsci/redhat-dependency-analytics-plugin/blob/f4b606b8b509795917edc2f2915c6a3322a85e4d/pom.xml#L212-L215 to access https://github.com/RHEcosystemAppEng/exhort-java-api

Can you recommend anything for our case?

We also thought about publishing exhort-java-api to Jenkins Artifactory.

1. Does this not contradict any rules for using Jenkins Artifactory?
2. Should we publish the artifact as a plugin component if we use this approach? Based on https://github.com/jenkins-infra/repository-permissions-updater/#managing-permissions

Thank you.

Reproduction steps

No response

[lemeurherve]

jenkinsci-dev mailing list initial discussion for reference: https://groups.google.com/g/jenkinsci-dev/c/aK4_a3zntgU

[timja]

Hmm unsure if we would want to take the jar to our artifactory if we aren't hosting the project too.

Can't you publish to something like Maven Central or JitPack.

You've hit the good reason no one really uses GitHub packages (except Docker) for Open Source libraries:
https://github.com/orgs/community/discussions/26634#discussioncomment-7061086

[dduportal]

For what it's worth, we've seen plugins using jars from the SCM itself and the pom.xml points to the local JAR using a repository with a file:// URL.
Example on https://github.com/jenkinsci/qualys-cs-plugin:

• https://github.com/jenkinsci/qualys-cs-plugin/blob/c27ff3edf63d4ae4f0a218a2d1af68ffea9ef3a5/pom.xml#L125-L130
• Jar file in https://github.com/jenkinsci/qualys-cs-plugin/tree/c27ff3edf63d4ae4f0a218a2d1af68ffea9ef3a5/lib/com/qualys/cs-plugin-common/1.2.5

[olavtar]

@dduportal Thank you.

[dduportal]

@dduportal Thank you.

Let us know if my hacki-sh method unblocks you

[dduportal]

At the same time, I'm closing this issue as no more actions are required for the Jenkins infra team.

Feel free to reopen if any problem arise.