Scanner fails to down load artifacts from github repositories (requires auth)

[nt-gt]

Describe the bug After working around #606, I encountering another failure. Namely that the scanner fails to download artifacts from our github repo. Regular maven works fine for the repo and the scanner does list the repo being tried.

Unfortunately, the scanner does not give me anything remotely useful for figuring why the download fails. My best guess is that it fails to authenticate properly even though the repo is correctly defined in my ~/.m2/settings.xml with a username and password (github access token).

Note the artifacts are public, but github insists on people providing an access token for maven downloads. (If someone here happens to know how to disable that "feature" and allow truly anonymous access, it would be an acceptable work around for me)

To Reproduce Steps to reproduce the behavior:

The source code is available at https://github.com/dcsaorg/DCSA-EBL-Envelope if you want to try it.

1. git clone https://github.com/dcsaorg/DCSA-EBL-Envelope at commit dcsaorg/DCSA-EBL-Envelope@ec5cbe9a99d4c4f310a19d93ec4cdf0f6ac9341f (part of the branch next-phase)
2. Follow the guide in https://github.com/dcsaorg/DCSA-Core/blob/master/README.md#setting-up-settingsxml to setup a github access token for the relevant repo.
3. Download the migrator from https://github.com/spring-projects-experimental/spring-boot-migrator/releases/tag/0.13.0
4. Apply the work around from #606
5. Run the migrator
6. Scan the download DCSA-EBL-Envelope
7. See error

Expected behavior That the scanner would not fail to download artifacts that maven can download.

Screenshots If applicable, add screenshots to help explain your problem.

Stacktrace If applicable, add the (sanitized) stacktrace here.

migrator:> stacktrace
org.openrewrite.maven.internal.MavenDownloadingException: Unable to download dependency org.dcsa.shared-kernel:dcsa-shared-kernel-parent:0.1.0 from the following repositories :
  - file:/C:/Users/nt/.m2/repository/
  - https://repo1.maven.org/maven2
  - https://maven.pkg.github.com/dcsaorg/DCSA-Core
  - [... irrelevant and private repos snippet ...]
  - https://repo1.maven.org/maven2
  - https://repo.maven.apache.org/maven2
        at org.openrewrite.maven.internal.MavenPomDownloader.download(MavenPomDownloader.java:311)
        at org.openrewrite.maven.tree.ResolvedPom$Resolver.mergeDependencyManagement(ResolvedPom.java:469)
        at org.openrewrite.maven.tree.ResolvedPom$Resolver.resolveParentDependenciesRecursively(ResolvedPom.java:376)
        at org.openrewrite.maven.tree.ResolvedPom$Resolver.resolveParentDependenciesRecursively(ResolvedPom.java:395)
        at org.openrewrite.maven.tree.ResolvedPom$Resolver.resolveParentsRecursively(ResolvedPom.java:328)
        at org.openrewrite.maven.tree.ResolvedPom$Resolver.resolve(ResolvedPom.java:297)
        at org.openrewrite.maven.tree.ResolvedPom.resolve(ResolvedPom.java:142)
        at org.openrewrite.maven.tree.Pom.resolve(Pom.java:92)
        at org.openrewrite.maven.MavenParser.parseInputs(MavenParser.java:113)
        at org.springframework.sbm.build.impl.RewriteMavenParser.parseInputs(RewriteMavenParser.java:93)
        at org.springframework.sbm.project.parser.MavenProjectParser.parse(MavenProjectParser.java:88)
        at org.springframework.sbm.project.parser.ProjectContextInitializer.initProjectContext(ProjectContextInitializer.java:53)
        at org.springframework.sbm.engine.commands.ScanCommand.execute(ScanCommand.java:57)
        at org.springframework.sbm.shell.ScanShellCommand.scan(ScanShellCommand.java:70)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at org.springframework.shell.command.invocation.InvocableShellMethod.doInvoke(InvocableShellMethod.java:306)
        at org.springframework.shell.command.invocation.InvocableShellMethod.invoke(InvocableShellMethod.java:232)
        at org.springframework.shell.command.CommandExecution$DefaultCommandExecution.evaluate(CommandExecution.java:158)
        at org.springframework.shell.Shell.evaluate(Shell.java:208)
        at org.springframework.shell.Shell.run(Shell.java:140)
        at org.springframework.shell.jline.InteractiveShellRunner.run(InteractiveShellRunner.java:73)
        at org.springframework.shell.DefaultShellApplicationRunner.run(DefaultShellApplicationRunner.java:65)
        at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:762)
        at org.springframework.boot.SpringApplication.callRunners(SpringApplication.java:752)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:315)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1306)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1295)
        at org.springframework.sbm.SpringShellApplication.main(SpringShellApplication.java:27)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49)
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:108)
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
        at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:65)

Desktop (please complete the following information):

• OS: e.g. Windows
• Version: e.g. 10

Additional context Add any other context about the problem here.

[fabapp2]

Hi @nt-gt Thank you for reporting and your detailed description. 🚀 As for #606 it will take some time to create an example with tests to reproduce. I will ping you as soon as I can reproduce the problem.

You might want to look into Jitpack to retrieve a dependency from a commit in a GH repo. Not sure if this would work for your needs though.