how to create your own maven repository on github

git-maven-howto.md

How to create a maven repository for your github project step by step

Clone your project in a separate folder

(note: replace ORGANIZATION and PROJECT)

git clone git clone git@github.com:ORGANIZATION/PROJECT.git my-repository

Cd into it

cd my-repository

Create a new branch (here named repository)

git branch repository

Switch to that branch

git checkout repository

Remove all files

rm -rf file1 file2 file3 .. etc

Install your jar in that directory

(note: replace YOUR_GROUP, YOUR_ARTIFACT, YOUR_VERSION and YOUR_JAR_FILE)

mvn install:install-file -DgroupId=YOUR_GROUP -DartifactId=YOUR_ARTIFACT -Dversion=YOUR_VERSION -Dfile=YOUR_JAR_FILE -Dpackaging=jar -DgeneratePom=true -DlocalRepositoryPath=.  -DcreateChecksum=true

YOUR_JAR_FILE should point to an existent jar file, this is why it's best to create your repository branch in a different folder, so you can reference the existing jar in /your/project/path/target/artifact-x.y.z.jar

Add all generated files, commit and push

git add -A . && git commit -m "released version X.Y.Z"

git push origin repository

Reference your jar from a different project

The repository url you just created is https://raw.github.com/YOUR_ORGANIZATION/YOUR_ARTIFACT/repository/

@eirikh1996
check this https://maven.apache.org/plugins/maven-install-plugin/install-file-mojo.html

you have to specify -Djavadoc & -Dsource arguments which is pathes to corresponding jar files like -Dfile argument

The generated POM doesn't contain dependencies. How to I make it use the original POM instead and copy it to the proper directories?

@prydin

please check this link https://maven.apache.org/plugins/maven-install-plugin/install-file-mojo.html. what you need is pomFile argument

Thanks! I suspected it was something really simple I had overlooked!

Github supports Maven packages now https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages

Yeah this worked. But isn't it a security risc?
Someone could provide a pom.xml and maven would just download a malicious library from a custom Repostory. Does it mean, we should check if the repostories defined in the pom are secure?

On the first line, maybe git clone git clone should be replaced with just git clone ?

@dgallegos
The current state of Github maven registries is severely lacking in usability.

You can't delete packages if your repository was a fork, so your only option is to delete the fork and recreate the packages in a private repository.
Also don't bother uploading snapshots because you will never be able to resolve them in maven/gradle. It's quite annoying because they said in their blog, that they now support snapshots, but now I'm not sure what they meant by this.

I did some manual digging and I found that it even messes up the names of the packages.

For example I had uploaded a package with the name groupid: com.foo artifactid: com.foo.bar version: 0.1.0-SNAPSHOT.

When I sent a GET request to https://maven.pkg.github.com/<owner>/<repo>/com/foo/com.foo.bar/maven-metadata.xml, I get this back:

<metadata>
    <groupId>com.foo.com.foo</groupId>
    <artifactId>bar</artifactId>
    <versioning>
        <latest>0.1.0-SNAPSHOT</latest>
        <versions>
            <version>0.1.0-SNAPSHOT</version>
        </versions>
        <lastUpdated>20200418063644</lastUpdated>
    </versioning>
</metadata>

Doesn't make sense.

So I'd say don't bother using it yet until they've worked out the issues.

I use repsy.io, It gives 1 GB of free private maven repository. It's enough for most of the projects.

Thanks for tutor it helped me a lot.

For me next command works with sources and docs

 mvn install:install-file -DgroupId=com.foo -DartifactId=bar -Dversion=0.0.1 -Dfile=~/tmp/bar/target/bar-0.0.1.jar -Dpackaging=jar -DgeneratePom=true -DlocalRepositoryPath=.  -DcreateChecksum=true -Dsources=/~/tmp/bar/target/bar-0.0.1-sources.jar -Djavadoc=~/tmp/bar/target/bar-0.0.1-javadoc.jar -DpomFile=~/tmp/bar/pom.xml 

and to use it

    <repositories>
        <repository>
            <id>private-repo</id>
            <name>Private Repository</name>
            <url>https://raw.githubusercontent.com/GITHUB_PROFILE/PROJECT/repository/</url>
            <releases>
                <enabled>true</enabled>
                <updatePolicy>never</updatePolicy>
            </releases>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>

@mikhail: i get a "400: Invalid request" if I call my repo like you mention.
What is the correct URL? The repo must be browsable within the browser in order to work within a regular maven build.

Excellent ! It works fine.

How to find the correct url?
I get "400: Invalid request" for all the urls formats mentioned above

Thanks

any way to directly publish on it without manually having to commit and push on the repository itself?

Sorry for shameless self-promotion, but I'd like to gather some feedbacks about one gradle plugin I've been working on: magik. Basically it allows to publish directly on a github repository acting as a maven repository. Github repos may serve for some nice custom solution since they allow up to 100GB total repo size with a max 100MB size for single file

I m getting 400 for the url. any correctiosn to the url above?