Cannot override TokenSource without a root project

[hejfelix]

Not specifying a root project will silently not allow you to override the the TokenSource. While it might not be the fault of this plugin, it's a big gotcha that might be causing a lot of confusion for others.
This combined with the fact that e.g. bloopInstall will try to evaluate the token can quickly lead to some head scratching. Maybe mentioning this in the README could help?

[lonniev]

We resolved similar issues (with use of the Lagom plugin’s runAll task) by removing this plugin (which served an informative purpose) and then much more directly declaring suitable Credentials entries.

When this plugin is studied, one comes to see that it does three things and nothing more:

1. It retrieves a token value from the first of two fixed choices: an env variable or the output of the git config query
2. It maps the user’s organization, repo, user id, and token to a suitable Credentials entry
3. It auto-binds itself to all explicitly defined and any dynamically instantiated projects

It is step 3 that causes the grief in moderately complex SBT builds.

If you don’t need all the (understandably) opinionated assumptions it makes and you don’t want its tactics and requirements associated with each and every project, then (rather simply) state the Credentials entries needed to authenticate with GH Packages sites and treat GitHub Packages like another other maven-like package repository.