diff --git a/__tests__/auth.test.ts b/__tests__/auth.test.ts
index 937d119d..4a3119d3 100644
--- a/__tests__/auth.test.ts
+++ b/__tests__/auth.test.ts
@@ -1,15 +1,22 @@
 import io = require('@actions/io');
 import fs = require('fs');
+import os = require('os');
 import path = require('path');
-import child_process = require('child_process');
 
-const m2Dir = path.join(__dirname, '.m2');
-const settingsFile = path.join(m2Dir, 'settings.xml');
+// make the os.homedir() call be local to the tests
+jest.doMock('os', () => {
+  return {
+    homedir: jest.fn(() => __dirname)
+  };
+});
 
 import * as auth from '../src/auth';
 
+const m2Dir = path.join(__dirname, auth.M2_DIR);
+const settingsFile = path.join(m2Dir, auth.SETTINGS_FILE);
+
 describe('auth tests', () => {
-  beforeAll(async () => {
+  beforeEach(async () => {
     await io.rmRF(m2Dir);
   }, 300000);
 
@@ -21,7 +28,7 @@ describe('auth tests', () => {
     }
   }, 100000);
 
-  it('Creates settings.xml file with username and password', async () => {
+  it('creates settings.xml with username and password', async () => {
     const username = 'bluebottle';
     const password = 'SingleOrigin';
 
@@ -33,4 +40,21 @@ describe('auth tests', () => {
       auth.generate(username, password)
     );
   }, 100000);
+
+  it('does not create settings.xml without username and / or password', async () => {
+    await auth.configAuthentication('FOO', '');
+
+    expect(fs.existsSync(m2Dir)).toBe(false);
+    expect(fs.existsSync(settingsFile)).toBe(false);
+
+    await auth.configAuthentication('', 'BAR');
+
+    expect(fs.existsSync(m2Dir)).toBe(false);
+    expect(fs.existsSync(settingsFile)).toBe(false);
+
+    await auth.configAuthentication('', ''); // BAZ!!!
+
+    expect(fs.existsSync(m2Dir)).toBe(false);
+    expect(fs.existsSync(settingsFile)).toBe(false);
+  }, 100000);
 });
diff --git a/src/auth.ts b/src/auth.ts
index 328c54f7..252423a8 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -4,28 +4,40 @@ import * as path from 'path';
 import * as core from '@actions/core';
 import * as io from '@actions/io';
 
+export const M2_DIR = '.m2';
+export const SETTINGS_FILE = 'settings.xml';
+
 export async function configAuthentication(username: string, password: string) {
-  const directory: string = path.join(os.homedir(), '.m2');
-  await io.mkdirP(directory);
-  await write(directory, generate(username, password));
+  if (username && password) {
+    core.debug(`configAuthentication with ${username} and a password`);
+    const directory: string = path.join(os.homedir(), M2_DIR);
+    await io.mkdirP(directory);
+    core.debug(`created directory ${directory}`);
+    await write(directory, generate(username, password));
+  } else {
+    core.debug(
+      `no auth without username: ${username} and password: ${password}`
+    );
+  }
 }
 
 // only exported for testing purposes
-export function generate(
-  username = '${actions.username}',
-  password = '${actions.password}'
-) {
-  return `<settings>
-                <servers>
-                <server>
-                    <username>${username}</username>
-                    <password>${password}</password>
-                </server>
-                </servers>
-            </settings>
-    `;
+export function generate(username: string, password: string) {
+  return `
+  <settings>
+      <servers>
+        <server>
+          <username>${username}</username>
+          <password>${password}</password>
+        </server>
+      </servers>
+  </settings>
+  `;
 }
 
 async function write(directory: string, settings: string) {
-  return fs.writeFileSync(path.join(directory, 'settings.xml'), settings);
+  const options = {encoding: 'utf-8'};
+  const location = path.join(directory, SETTINGS_FILE);
+  core.debug(`writing ${location}`);
+  return fs.writeFileSync(location, settings, options);
 }
diff --git a/src/setup-java.ts b/src/setup-java.ts
index e6b179ed..9e52f9b1 100644
--- a/src/setup-java.ts
+++ b/src/setup-java.ts
@@ -18,9 +18,7 @@ async function run() {
     const username = core.getInput('username', {required: false});
     const password = core.getInput('password', {required: false});
 
-    if (username && password) {
-      await auth.configAuthentication(username, password);
-    }
+    await auth.configAuthentication(username, password);
 
     const matchersPath = path.join(__dirname, '..', '.github');
     console.log(`##[add-matcher]${path.join(matchersPath, 'java.json')}`);