GitHub Action部署Maven Central遇git公钥权限拒绝问题求助

配置GitHub Action发布到Maven Central时，执行maven-release-plugin的prepare阶段失败，报错如下：

Error:  Failed to execute goal org.apache.maven.plugins:maven-release-plugin:2.5.3:prepare (default-cli) on project homeautomation-parent: Unable to commit files
Error:  Provider message:
Error:  The git-push command failed.
Error:  Command output:
Error:  git@github.com: Permission denied (publickey).
Error:  fatal: Could not read from remote repository.

已配置GITHUB_TOKEN并赋予了完整的写入权限，但问题依然存在。请问忽略了什么配置细节？是否需要为actions@github.com创建SSH Token，或是使用个人SSH Token？

当前配置信息 #

GITHUB_TOKEN权限

GITHUB_TOKEN Permissions
  Actions: write
  Checks: write
  Contents: write
  Deployments: write
  Discussions: write
  Issues: write
  Metadata: read
  Packages: write
  Pages: write
  PullRequests: write
  RepositoryProjects: write
  SecurityEvents: write
  Statuses: write

Workflow文件

name: Publish package to the Maven Central Repository

on:
  workflow_dispatch:
    inputs:
      releaseVersion:
        description: "Define the release version"
        required: true
        default: ""
      developmentVersion:
        description: "Define the snapshot version"
        required: true
        default: ""

jobs:
  build:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4    
    - run: |
        git config user.email "actions@github.com"
        git config user.name "GitHub Actions"
    - name: Set up Maven Central Repository
      uses: actions/setup-java@v3
      with:
        distribution: 'temurin'
        java-version: '17'
        server-id: ossrh # Value of the distributionManagement/repository/id field of the pom.xml
        server-username: MAVEN_USERNAME # env variable for username in deploy
        server-password: MAVEN_PASSWORD # env variable for token in deploy
        gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
        gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase

    - name: Release & Publish to Apache Maven Central
      run: mvn -U -B -Prelease release:prepare release:perform -DreleaseVersion=${{ github.event.inputs.releaseVersion }} -DdevelopmentVersion=${{ github.event.inputs.developmentVersion }} deploy
      env:
        MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
        MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
        MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}

pom.xml关键SCM配置

<scm>
    <connection>scm:git:ssh://git@github.com/davemeier82/homeautomation-parent.git</connection>
    <developerConnection>scm:git:ssh://git@github.com/davemeier82/homeautomation-parent.git</developerConnection>
    <url>https://github.com/davemeier82/homeautomation-parent</url>
    <tag>homeautomation-parent-0.2.3-SNAPSHOT</tag>
</scm>

核心原因 #

pom.xml的SCM配置使用了SSH协议地址（ssh://git@github.com/...），但GITHUB_TOKEN是HTTPS协议专属的凭证。maven-release-plugin会读取SCM地址执行git push操作，此时没有对应的SSH密钥完成身份验证，因此触发权限拒绝错误。

方案一：改用HTTPS地址复用GITHUB_TOKEN（推荐） #

无需额外配置SSH密钥，直接调整SCM和Workflow即可：

1. 修改pom.xml的SCM配置为HTTPS格式：

<scm>
    <connection>scm:git:https://github.com/davemeier82/homeautomation-parent.git</connection>
    <developerConnection>scm:git:https://github.com/davemeier82/homeautomation-parent.git</developerConnection>
    <url>https://github.com/davemeier82/homeautomation-parent</url>
    <tag>homeautomation-parent-0.2.3-SNAPSHOT</tag>
</scm>

2. 更新actions/checkout步骤，指定token并拉取完整git历史：

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
    token: ${{ secrets.GITHUB_TOKEN }}

3. 执行maven命令时，添加-Dusername=${{ secrets.GITHUB_TOKEN }}参数，让插件用token完成HTTPS身份验证：

mvn -U -B -Prelease release:prepare release:perform -DreleaseVersion=${{ github.event.inputs.releaseVersion }} -DdevelopmentVersion=${{ github.event.inputs.developmentVersion }} -Dusername=${{ secrets.GITHUB_TOKEN }} deploy

方案二：配置SSH密钥（适用于坚持用SSH协议的场景） #

1. 生成专用SSH密钥对，将公钥添加到GitHub仓库的部署密钥中，并勾选"Allow write access"。
2. 将私钥存入GitHub仓库Secrets（命名为SSH_PRIVATE_KEY）。
3. 在Workflow中添加SSH配置步骤：

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- name: Configure SSH
  uses: webfactory/ssh-agent@v0.7.0
  with:
    ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
- run: |
    git config user.email "actions@github.com"
    git config user.name "GitHub Actions"
    ssh-keyscan github.com >> ~/.ssh/known_hosts

注意事项 #

• maven-release-plugin:prepare需要修改版本号并提交push，必须确保git操作拥有仓库写入权限。
• 不要使用个人日常SSH密钥作为部署密钥，专用部署密钥能降低账号泄露风险。

内容的提问来源于stack exchange，提问作者Dave