Bug Report

Describe the Bug

RepositoriesConvention in the edc-build plugin registers the project repositories in this order, without any content filtering:

repositories.mavenLocal();
repositories.maven(repo -> repo.setUrl(URI.create("https://central.sonatype.com/repository/maven-snapshots/")));
repositories.mavenCentral();

So on a clean runner every third-party dependency (Jackson, Jersey, Micrometer, org.jetbrains:annotations, ...) is looked up on the Sonatype snapshots repository first, before falling back to Maven Central. On a large build like the Connector this means thousands of useless requests to Sonatype, which then rate-limits the runner with HTTP 429 Too Many Requests.

Unlike a 404, a 429 makes Gradle disable the repository for the rest of the build, and every dependency that still has to be resolved fails with Repository maven is disabled due to earlier error, even when it is available on Maven Central.

Expected Behavior

Only -SNAPSHOT artifacts should be looked up on the snapshots repository; release artifacts should go straight to Maven Central.

Observed Behavior

The Connector 0.18.2 bugfix release keeps failing (also after several re-runs) with:

Execution failed for task ':extensions:common:http:jersey-micrometer:compileJava'.
> Could not resolve all files for configuration ':extensions:common:http:jersey-micrometer:compileClasspath'.
   > Could not resolve io.micrometer:micrometer-core:1.17.0.
      > Repository maven is disabled due to earlier error below:
         > Could not resolve org.jetbrains:annotations:13.0.
            > Could not get resource 'https://central.sonatype.com/repository/maven-snapshots/org/jetbrains/annotations/13.0/annotations-13.0.pom'.
               > Could not HEAD '...'. Received status code 429 from server: Too Many Requests

Ref: https://github.com/eclipse-edc/Connector/actions/runs/43221782819/job/131194838067

Steps to Reproduce

1. Run a build of a big EDC project (e.g. Connector ./gradlew allDependencies followed by ./gradlew compileJava build) with an empty Gradle cache
2. Observe that every dependency is requested on central.sonatype.com/repository/maven-snapshots first
3. Eventually Sonatype answers 429 and the build fails

Context Information

• edc-build 1.5.2
• Gradle 9.5.1

Possible Implementation

Restrict the snapshots repository to snapshot versions (and optionally to the EDC groups), and/or declare Maven Central before it:

repositories.mavenLocal();
repositories.mavenCentral();
repositories.maven(repo -> {
    repo.setUrl(URI.create(Repositories.SNAPSHOT_REPO_URL));
    repo.mavenContent(MavenRepositoryContentDescriptor::snapshotsOnly);
});

As a workaround the same filter has been applied in the Connector root build.gradle.kts, which keeps the requests to the snapshots repository limited to org.eclipse.edc:*:*-SNAPSHOT artifacts:

allprojects {
    repositories.withType<MavenArtifactRepository>().configureEach {
        if (url.toString().contains("/maven-snapshots")) {
            mavenContent { snapshotsOnly() }
        }
    }
}