Update artifactory-oidc to extract existing settings.xml info

artifactory-oidc/action.yml

@@ -202,11 +202,31 @@ runs:
             ;;
           maven)
             mkdir -p ~/.m2/
+
+            # actions/setup-java (run before this action) may have already written
+            # ~/.m2/settings.xml with its own <servers> (e.g. GitHub Packages
+            # credentials), <profiles> (custom repositories, GPG passphrase), and
+            # <activeProfiles>. We overwrite this file, so extract those blocks
+            # first and splice them back in — otherwise we'd silently drop
+            # credentials/config the calling workflow depends on.
+            EXISTING_SERVERS=""
+            EXISTING_PROFILES=""
+            EXISTING_ACTIVE_PROFILES=""
+            if [ -f ~/.m2/settings.xml ]; then
+              echo "::notice::Found existing ~/.m2/settings.xml (e.g. from actions/setup-java) — merging its <servers>, <profiles>, and <activeProfiles>"
+              EXISTING_SERVERS=$(python3 "$GITHUB_ACTION_PATH/extract-xml-children.py" ~/.m2/settings.xml servers)
+              EXISTING_PROFILES=$(python3 "$GITHUB_ACTION_PATH/extract-xml-children.py" ~/.m2/settings.xml profiles)
+              EXISTING_ACTIVE_PROFILES=$(python3 "$GITHUB_ACTION_PATH/extract-xml-children.py" ~/.m2/settings.xml activeProfiles)
+            fi
+
             # Pass vars explicitly into envsubst's environment so the child process can see them.
             ART_USERNAME="$ART_USERNAME" \
             ART_TOKEN="$ART_TOKEN" \
             ARTIFACTORY_URL="$ARTIFACTORY_URL" \
             REGISTRY_PATH="$REGISTRY_PATH" \
+            EXISTING_SERVERS="$EXISTING_SERVERS" \
+            EXISTING_PROFILES="$EXISTING_PROFILES" \
+            EXISTING_ACTIVE_PROFILES="$EXISTING_ACTIVE_PROFILES" \
               envsubst < "$GITHUB_ACTION_PATH/maven-settings.xml.tmpl" > ~/.m2/settings.xml
             echo "::notice::Maven configured to use Artifactory registry (${REGISTRY_PATH})"
             ;;

artifactory-oidc/extract-xml-children.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Print the child elements of the first <tag> found in an XML file, ignoring
+namespaces, as XML fragments (bare of namespace declarations). Used in place
+of `xmllint --xpath "//*[local-name()='TAG']/*"`, which isn't installed on
+GitHub-hosted runners by default.
+
+Usage: extract-xml-children.py <file> <tag>
+"""
+import sys
+import xml.etree.ElementTree as ET
+
+
+def strip_ns(el: ET.Element) -> ET.Element:
+    """
+    Remove the namespace from the default {namespace_namespace}tag_name representation
+
+    Instead of {http://maven....}server, we'd get server
+    """
+    el.tag = el.tag.rsplit("}", 1)[-1]
+    for child in el:
+        strip_ns(child)
+    return el
+
+
+def main() -> None:
+    path, tag = sys.argv[1], sys.argv[2]
+    root = ET.parse(path).getroot()
+    for el in root.iter():
+        if el.tag.rsplit("}", 1)[-1] == tag:
+            for child in list(el):
+                sys.stdout.write(ET.tostring(strip_ns(child), encoding="unicode"))
+            return
+    pass # No matching parent element found — print nothing.
+
+
+if __name__ == "__main__":
+    main()

artifactory-oidc/maven-settings.xml.tmpl

@@ -9,6 +9,7 @@
       <username>${ART_USERNAME}</username>
       <password>${ART_TOKEN}</password>
     </server>
+    ${EXISTING_SERVERS}
   </servers>
   <mirrors>
     <mirror>
@@ -17,4 +18,10 @@
       <url>${ARTIFACTORY_URL}/artifactory/${REGISTRY_PATH}</url>
     </mirror>
   </mirrors>
+  <profiles>
+    ${EXISTING_PROFILES}
+  </profiles>
+  <activeProfiles>
+    ${EXISTING_ACTIVE_PROFILES}
+  </activeProfiles>
 </settings>