Skip to content

fix: route plugin and build-logic deps through mavenRepositoryProxy#514

Merged
jbachorik merged 3 commits into
mainfrom
roberto.ayuso/build-logic-depot-proxy
May 7, 2026
Merged

fix: route plugin and build-logic deps through mavenRepositoryProxy#514
jbachorik merged 3 commits into
mainfrom
roberto.ayuso/build-logic-depot-proxy

Conversation

@robayu

@robayu robayu commented May 7, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • The mavenRepositoryProxy Gradle property was only consulted in the root dependencyResolutionManagement. Plugin classpath resolution and the build-logic included build still hit gradlePluginPortal()/mavenCentral() directly, so on CI runners that restrict egress to the Depot mirror those fetches fail with 403 Forbidden.
  • This caused :build-logic:conventions:compileKotlin to fail downloading kotlin-build-tools-impl-2.3.0.jar and kotlin-reflect-1.6.10.jar (sample failure: job 1664033372).
  • Wires the proxy into three places so plugin and build-logic resolution also flow through Depot when the property is set:
    • root pluginManagement in settings.gradle.kts
    • build-logic/settings.gradle pluginManagement (the included build had none)
    • repositories {} in build-logic/conventions/build.gradle.kts (the actual failing config: kotlinBuildToolsApiClasspath)

The proxy is only added when the property is set, so local builds without -PmavenRepositoryProxy=... continue to behave as before. CI exports ORG_GRADLE_PROJECT_mavenRepositoryProxy already, so no .gitlab-ci.yml changes are needed.

Test plan

  • CI pipeline on this branch reaches :build-logic:conventions:compileKotlin and resolves kotlin-build-tools-impl / kotlin-reflect through depot-read-api-java.us1.ddbuild.io (no 403s in the build log).
  • Local ./gradlew tasks (without the property set) still succeeds — proxy block is no-op when the property is absent.

🤖 Generated with Claude Code

The mavenRepositoryProxy Gradle property was only consulted in the root
dependencyResolutionManagement, so plugin classpath resolution and the
build-logic included build still hit gradlePluginPortal/mavenCentral
directly. CI runners that restrict egress to the Depot mirror return
403 for those direct fetches, which broke ':build-logic:conventions:
compileKotlin' on kotlin-build-tools-impl and kotlin-reflect.

Wire the proxy into the root pluginManagement, the build-logic settings
pluginManagement, and the conventions project repositories. The proxy
is only added when the property is set, so local builds without it
behave as before.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@robayu robayu requested a review from a team as a code owner May 7, 2026 13:49

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9f734f4919

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread settings.gradle.kts
buildscript {} repositories are resolved independently of
dependencyResolutionManagement, so com.dipien:semantic-version-gradle-
plugin still hits mavenCentral/gradlePluginPortal directly and 403s
on egress-restricted runners. Add the proxy here too, ahead of the
public mirrors.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@robayu

robayu commented May 7, 2026

Copy link
Copy Markdown
Collaborator Author

Good catch — pushed 5387d26e wiring mavenRepositoryProxy into the root buildscript.repositories block ahead of mavenCentral()/gradlePluginPortal(), so com.dipien:semantic-version-gradle-plugin now resolves through Depot when the property is set.

Note: the allprojects { repositories { ... } } block and the root project's own repositories { ... } block further down don't actually fetch anything because settings.gradle.kts sets RepositoriesMode.PREFER_SETTINGS — under that mode project-level repositories are ignored (with a warning) and the settings-level resolution wins. So those don't need to change for the 403 issue. Happy to clean them up in a separate PR if you'd like.

The Depot magicmirror previously served a corrupted (POM-as-JAR)
response for kotlin-compiler-embeddable-2.3.20.jar, which surfaced
once Gradle 9.5 (PR #506) started pulling that artifact via the
proxy added on this branch. The bad row has been cleared and
re-ingestion now serves the correct ~57 MB JAR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@dd-octo-sts

dd-octo-sts Bot commented May 7, 2026

Copy link
Copy Markdown
Contributor

CI Test Results

Run: #25502656285 | Commit: f505b46 | Duration: 32m 47s (longest job)

All 32 test jobs passed

Status Overview

JDK glibc-aarch64/debug glibc-amd64/debug musl-aarch64/debug musl-amd64/debug
8 - - -
8-ibm - - -
8-j9 - -
8-librca - -
8-orcl - - -
11 - - -
11-j9 - -
11-librca - -
17 - -
17-graal - -
17-j9 - -
17-librca - -
21 - -
21-graal - -
21-librca - -
25 - -
25-graal - -
25-librca - -

Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled

Summary: Total: 32 | Passed: 32 | Failed: 0


Updated: 2026-05-07 15:16:22 UTC

@jbachorik jbachorik merged commit d84ad06 into main May 7, 2026
98 checks passed
@jbachorik jbachorik deleted the roberto.ayuso/build-logic-depot-proxy branch May 7, 2026 16:20
@github-actions github-actions Bot added this to the 1.43.0 milestone May 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants