Clarify credential environment variable inputs (#1134)

* Clarify credential environment variable inputs

Rename credential-related inputs to make their environment-variable semantics explicit while preserving deprecated aliases with migration warnings.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 70a3daa8-dbc9-4eb0-a57b-df198a459315

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

src/auth.ts

@@ -12,8 +12,16 @@ import {getBooleanInput} from './util.js';
 
 export async function configureAuthentication() {
   const id = core.getInput(constants.INPUT_SERVER_ID);
-  const username = core.getInput(constants.INPUT_SERVER_USERNAME);
-  const password = core.getInput(constants.INPUT_SERVER_PASSWORD);
+  const usernameEnvVar = getInputWithDeprecatedAlias(
+    constants.INPUT_SERVER_USERNAME_ENV_VAR,
+    constants.INPUT_SERVER_USERNAME_DEPRECATED,
+    constants.INPUT_DEFAULT_SERVER_USERNAME
+  );
+  const passwordEnvVar = getInputWithDeprecatedAlias(
+    constants.INPUT_SERVER_PASSWORD_ENV_VAR,
+    constants.INPUT_SERVER_PASSWORD_DEPRECATED,
+    constants.INPUT_DEFAULT_SERVER_PASSWORD
+  );
   const settingsDirectory =
     core.getInput(constants.INPUT_SETTINGS_PATH) ||
     path.join(os.homedir(), constants.M2_DIR);
@@ -24,9 +32,11 @@ export async function configureAuthentication() {
   const gpgPrivateKey =
     core.getInput(constants.INPUT_GPG_PRIVATE_KEY) ||
     constants.INPUT_DEFAULT_GPG_PRIVATE_KEY;
-  const gpgPassphrase =
-    core.getInput(constants.INPUT_GPG_PASSPHRASE) ||
-    (gpgPrivateKey ? constants.INPUT_DEFAULT_GPG_PASSPHRASE : undefined);
+  const gpgPassphraseEnvVar = getInputWithDeprecatedAlias(
+    constants.INPUT_GPG_PASSPHRASE_ENV_VAR,
+    constants.INPUT_GPG_PASSPHRASE_DEPRECATED,
+    gpgPrivateKey ? constants.INPUT_DEFAULT_GPG_PASSPHRASE : undefined
+  );
 
   if (gpgPrivateKey) {
     core.setSecret(gpgPrivateKey);
@@ -34,11 +44,11 @@ export async function configureAuthentication() {
 
   await createAuthenticationSettings(
     id,
-    username,
-    password,
+    usernameEnvVar,
+    passwordEnvVar,
     settingsDirectory,
     overwriteSettings,
-    gpgPassphrase
+    gpgPassphraseEnvVar
   );
 
   if (gpgPrivateKey) {
@@ -48,13 +58,30 @@ export async function configureAuthentication() {
   }
 }
 
+export function getInputWithDeprecatedAlias(
+  inputName: string,
+  deprecatedInputName: string,
+  defaultValue?: string
+): string {
+  const value = core.getInput(inputName);
+  const deprecatedValue = core.getInput(deprecatedInputName);
+
+  if (deprecatedValue) {
+    core.warning(
+      `The '${deprecatedInputName}' input is deprecated and may be removed in a future release. Please use '${inputName}' instead.`
+    );
+  }
+
+  return value || deprecatedValue || defaultValue || '';
+}
+
 export async function createAuthenticationSettings(
   id: string,
-  username: string,
-  password: string,
+  usernameEnvVar: string,
+  passwordEnvVar: string,
   settingsDirectory: string,
   overwriteSettings: boolean,
-  gpgPassphrase: string | undefined = undefined
+  gpgPassphraseEnvVar: string | undefined = undefined
 ) {
   core.info(`Creating ${constants.MVN_SETTINGS_FILE} with server-id: ${id}`);
   // when an alternate m2 location is specified use only that location (no .m2 directory)
@@ -62,7 +89,7 @@ export async function createAuthenticationSettings(
   await io.mkdirP(settingsDirectory);
   await write(
     settingsDirectory,
-    generate(id, username, password, gpgPassphrase),
+    generate(id, usernameEnvVar, passwordEnvVar, gpgPassphraseEnvVar),
     overwriteSettings
   );
 }
@@ -70,9 +97,9 @@ export async function createAuthenticationSettings(
 // only exported for testing purposes
 export function generate(
   id: string,
-  username: string,
-  password: string,
-  gpgPassphrase?: string | undefined
+  usernameEnvVar: string,
+  passwordEnvVar: string,
+  gpgPassphraseEnvVar?: string | undefined
 ) {
   const xmlObj: {[key: string]: any} = {
     settings: {
@@ -85,8 +112,8 @@ export function generate(
         server: [
           {
             id: id,
-            username: `\${env.${username}}`,
-            password: `\${env.${password}}`
+            username: `\${env.${usernameEnvVar}}`,
+            password: `\${env.${passwordEnvVar}}`
           }
         ]
       }
@@ -100,14 +127,14 @@ export function generate(
   // are needed. Writing `gpg.passphrase` to settings.xml is deprecated and fails
   // when the plugin's `bestPractices` mode is enabled.
   if (
-    gpgPassphrase &&
-    gpgPassphrase !== constants.MAVEN_GPG_PASSPHRASE_DEFAULT_ENV
+    gpgPassphraseEnvVar &&
+    gpgPassphraseEnvVar !== constants.MAVEN_GPG_PASSPHRASE_DEFAULT_ENV
   ) {
     xmlObj.settings.profiles = {
       profile: {
         id: constants.GPG_PASSPHRASE_PROFILE_ID,
         properties: {
-          'gpg.passphraseEnvName': gpgPassphrase
+          'gpg.passphraseEnvName': gpgPassphraseEnvVar
         }
       }
     };

src/constants.ts

@@ -12,13 +12,18 @@ export const INPUT_PROBLEM_MATCHER = 'problem-matcher';
 export const INPUT_VERIFY_SIGNATURE = 'verify-signature';
 export const INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
 export const INPUT_SERVER_ID = 'server-id';
-export const INPUT_SERVER_USERNAME = 'server-username';
-export const INPUT_SERVER_PASSWORD = 'server-password';
+export const INPUT_SERVER_USERNAME_ENV_VAR = 'server-username-env-var';
+export const INPUT_SERVER_PASSWORD_ENV_VAR = 'server-password-env-var';
+export const INPUT_SERVER_USERNAME_DEPRECATED = 'server-username';
+export const INPUT_SERVER_PASSWORD_DEPRECATED = 'server-password';
 export const INPUT_SETTINGS_PATH = 'settings-path';
 export const INPUT_OVERWRITE_SETTINGS = 'overwrite-settings';
 export const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
-export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
+export const INPUT_GPG_PASSPHRASE_ENV_VAR = 'gpg-passphrase-env-var';
+export const INPUT_GPG_PASSPHRASE_DEPRECATED = 'gpg-passphrase';
 
+export const INPUT_DEFAULT_SERVER_USERNAME = 'GITHUB_ACTOR';
+export const INPUT_DEFAULT_SERVER_PASSWORD = 'GITHUB_TOKEN';
 export const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined;
 export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';