From 38627d7d5afbada0b0fa3748c76fbfe975179553 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 1 Sep 2026 20:19:13 +0000 Subject: [PATCH 1/2] fix(ci): publish snapshots to maven.pinont.me repo root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pages-repo.yml never installed singularitylib-processor, so mvn deploy failed on every main push. Install the processor first (same as build.yml), stage processor + lib into a file repo, clone singularity-maven into runner.temp (Maven's target/ is non-empty), and overlay staging onto the gh-pages root that maven.pinont.me already serves — not a /repo/ subfolder — without deleting /javadoc/. Co-authored-by: Nonnipat Tangrojjanakhajorn --- .github/workflows/pages-repo.yml | 38 ++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pages-repo.yml b/.github/workflows/pages-repo.yml index bfacff7..51910e8 100644 --- a/.github/workflows/pages-repo.yml +++ b/.github/workflows/pages-repo.yml @@ -5,10 +5,17 @@ on: branches: [ main, "rework/v2" ] workflow_dispatch: +# Shared with JavaDoc publishing so Maven-layout and docs pushes to +# Pinont/singularity-maven gh-pages do not race. +concurrency: + group: singularity-maven-gh-pages + cancel-in-progress: false + jobs: deploy: # Pushes the maven repo layout to Pinont/singularity-maven (Pages-served, # anonymous reads). Accumulative: previously published versions are kept. + # JavaDoc HTML lives under /javadoc/ — overlay only; do not delete that tree. runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 @@ -17,19 +24,36 @@ jobs: with: distribution: temurin java-version: '25' + - name: Install annotation processor module + # singularitylib-processor is a standalone module (the root pom is a jar, + # not an aggregator), so install it into the local repo first — the lib + # compiles against it via annotationProcessorPaths. Same step as build.yml. + run: mvn -q install -f singularitylib-processor/pom.xml - name: Stage maven repo layout - run: mvn -q clean deploy -DskipTests -DaltDeploymentRepository=pages::default::file:${{ github.workspace }}/staging + # File-repo deploy. maven.pinont.me serves group paths at the Pages root + # (https://maven.pinont.me/io/github/pinont/...), not under /repo/. + run: | + STAGING="${{ github.workspace }}/staging" + mvn -q deploy -f singularitylib-processor/pom.xml -DskipTests \ + -DaltDeploymentRepository=pages::default::file:${STAGING} + mvn -q clean deploy -DskipTests \ + -DaltDeploymentRepository=pages::default::file:${STAGING} - name: Clone target repo (gh-pages branch) + # Clone into runner.temp — Maven's `target/` already exists after deploy, + # so `git clone … target` would fail (non-empty destination). run: | - git clone --depth 1 --branch gh-pages "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" target || { - cd target 2>/dev/null || git clone "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" target - cd target && git checkout -b gh-pages || true + DEST="${{ runner.temp }}/singularity-maven" + git clone --depth 1 --branch gh-pages "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" "$DEST" || { + git clone "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" "$DEST" + git -C "$DEST" checkout -b gh-pages || true } - name: Sync artifacts in (accumulative) run: | - mkdir -p target/repo - cp -R staging/. target/repo/ - cd target + DEST="${{ runner.temp }}/singularity-maven" + # Overlay onto gh-pages root (io/, com/, …). Do not nest under repo/, + # and do not delete javadoc/, CNAME, or .nojekyll. + cp -R staging/. "$DEST/" + cd "$DEST" git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git add -A From ae73b0741eed47b001c2d49b428f15f92d586e85 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 1 Sep 2026 20:26:20 +0000 Subject: [PATCH 2/2] fix(ci): push gh-pages with MAVEN_REPO_TOKEN, not GITHUB_TOKEN Dispatch run 33554760652 got past processor install, file deploy, and clone; git add/commit succeeded (not safe.directory). git push then failed with exit 128: Invalid username or token for singularity-maven. actions/checkout persist-credentials extraheader injects GITHUB_TOKEN into github.com HTTP, so clone of the public repo succeeds and push uses the wrong credentials. Disable persist-credentials, reset origin to the PAT URL, and blank extraheader on clone/push. Co-authored-by: Nonnipat Tangrojjanakhajorn --- .github/workflows/pages-repo.yml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pages-repo.yml b/.github/workflows/pages-repo.yml index 51910e8..2cef78d 100644 --- a/.github/workflows/pages-repo.yml +++ b/.github/workflows/pages-repo.yml @@ -19,6 +19,13 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + # This job never pushes back to SingularityLib. Leaving the default + # persist-credentials extraheader (GITHUB_TOKEN) in place makes + # later git clone/push to Pinont/singularity-maven use the wrong + # token: clone of a public repo still succeeds, then `git push` + # fails with "Invalid username or token" (run 33554760652). + persist-credentials: false - name: Setup JDK 25 uses: actions/setup-java@v4 with: @@ -41,24 +48,33 @@ jobs: - name: Clone target repo (gh-pages branch) # Clone into runner.temp — Maven's `target/` already exists after deploy, # so `git clone … target` would fail (non-empty destination). + env: + MAVEN_REPO_TOKEN: ${{ secrets.MAVEN_REPO_TOKEN }} run: | DEST="${{ runner.temp }}/singularity-maven" - git clone --depth 1 --branch gh-pages "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" "$DEST" || { - git clone "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" "$DEST" + AUTH_URL="https://x-access-token:${MAVEN_REPO_TOKEN}@github.com/Pinont/singularity-maven.git" + git -c "http.https://github.com/.extraheader=" clone --depth 1 --branch gh-pages "$AUTH_URL" "$DEST" || { + git -c "http.https://github.com/.extraheader=" clone "$AUTH_URL" "$DEST" git -C "$DEST" checkout -b gh-pages || true } + git -C "$DEST" remote set-url origin "$AUTH_URL" - name: Sync artifacts in (accumulative) + env: + MAVEN_REPO_TOKEN: ${{ secrets.MAVEN_REPO_TOKEN }} run: | DEST="${{ runner.temp }}/singularity-maven" + AUTH_URL="https://x-access-token:${MAVEN_REPO_TOKEN}@github.com/Pinont/singularity-maven.git" # Overlay onto gh-pages root (io/, com/, …). Do not nest under repo/, # and do not delete javadoc/, CNAME, or .nojekyll. cp -R staging/. "$DEST/" cd "$DEST" git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git remote set-url origin "$AUTH_URL" git add -A git diff --cached --quiet && echo "No changes" || git commit -m "publish ${{ github.sha }}" - git push origin gh-pages + # Blank extraheader so a leftover GITHUB_TOKEN cannot override the PAT. + git -c "http.https://github.com/.extraheader=" push origin gh-pages - name: Trigger Pages rebuild run: | curl -s -X POST \