Repositories to resolve Maven artifacts from seem to be tampered with #454

Description:

In our tests that we run in GitHub actions that use setup-java we verify the full URLs where artifacts in Maven / Gradle test projects have been resolved from (as our project is about dependency analysis).

With a recent change that fixes the order of Maven repositories to search for artifacts on our side, we realized that the new expected test results fail on GitHub actions while the same tests pass locally (tested on Windows, Linux, Docker).

So it seems that it's probably setup-java that's somehow tampering with Maven artifact resolution. As a Maven settings.xml takes precedence over repositories declared in POMs, I added a commit to my PR that should avoid setup-java to write a settings.xml, but the issue remains.

Task version:

actions/setup-java@v3

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:

See the GradleKotlinScriptFunTest and SbtFunTest test failures in https://github.com/oss-review-toolkit/ort/actions/runs/4196901639/jobs/7278510514.

Expected behavior:

All dependencies for the Gradle test project used by GradleKotlinScriptFunTest should be resolved from JCenter.

Actual behavior:

Only on GitHub actions with setup-java, dependencies are resolved from Maven Central instead of JCenter, e.g from

https://repo.maven.apache.org/maven2/org/jetbrains/annotations/13.0/annotations-13.0.jar

instead of the expected

https://jcenter.bintray.com/org/jetbrains/annotations/13.0/annotations-13.0.jar