Configuration to use Depot on GitLab Ci to avoid rate limiting with Maven Central.

[AlexeyKuznetsov-DD]

What Does This Do

Makes the configured Maven repository proxy authoritative for general dependency resolution:

• Gradle project repositories use mavenRepositoryProxy when configured and use mavenCentral() only when the proxy property is absent.
• Muzzle uses only MAVEN_REPOSITORY_PROXY when configured instead of querying both the proxy and Maven Central.

GitLab CI already supplies these proxy settings, so CI resolves these dependencies through Depot. Local and external builds without the settings continue to use Maven Central.

Motivation

The main source of direct Maven Central traffic was the latest-dependency configurations that use dynamic versions such as 2.+, 2.7.+, and 2.3.20+.

For a dynamic selector, Gradle must discover all matching versions. Gradle documentation explains that Gradle checks every defined repository for version metadata rather than stopping after the first repository responds. Consequently, declaring Depot first and Maven Central second did not make Central a passive fallback: Gradle requested maven-metadata.xml from both repositories for each dynamic dependency.

Under parallel CI load, those direct requests can accumulate behind shared egress and eventually result in Maven Central rate limiting. A representative failure was:

Could not resolve com.typesafe.play:play-java_2.13:2.7.+.
Could not GET .../maven-metadata.xml.
Received status code 429 from server: Too Many Requests

Muzzle had the same issue for its version-range scans because its default repository list contained both the proxy and Maven Central.

This change keeps Depot as the general remote repository whenever the proxy is configured, so dynamic-version and Muzzle range lookups no longer query Maven Central alongside Depot through the general repository list.

Additional Notes

Validation:

• Resolved org.glassfish.grizzly:grizzly-http-server:2.3.20+ for latestDepTestRuntimeClasspath with the proxy configured; the resolver log showed Depot serving the metadata and no request to Maven Central.
• ./gradlew :buildSrc:test --tests datadog.gradle.plugin.muzzle.MuzzleMavenRepoUtilsTest — 4 tests passed.
• ./gradlew :buildSrc:spotlessCheck

Specialized repositories with explicit content filters are unchanged.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

[datadog-prod-us1-5]

More details

Proxy-disabled builds retain Maven Central, while proxy-enabled Muzzle directives still append their explicit framework repositories and Gradle builds retain the dedicated snapshot, Confluent, Spring, and Gradle repositories. The changed fallback behavior is consistent with making Depot authoritative for Central artifacts.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit e3069e7 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.87 s	14.86 s	[-1.2%; +1.4%] (no difference)
startup:insecure-bank:tracing:Agent	13.63 s	13.74 s	[-1.5%; -0.1%] (maybe better)
startup:petclinic:appsec:Agent	17.44 s	17.32 s	[-0.1%; +1.4%] (no difference)
startup:petclinic:iast:Agent	17.43 s	16.97 s	[-1.7%; +7.2%] (no difference)
startup:petclinic:profiling:Agent	17.41 s	17.39 s	[-1.2%; +1.4%] (no difference)
startup:petclinic:sca:Agent	17.51 s	16.52 s	[+1.6%; +10.3%] (significantly worse)
startup:petclinic:tracing:Agent	16.59 s	16.68 s	[-1.5%; +0.5%] (no difference)

Commit: 357e8a8a · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-prod-us1-5]

A present-but-blank proxy value is now treated as authoritative, removing Maven Central from general Gradle and Muzzle resolution. Shell-based CI can materialize missing optional variables as empty strings, turning a clean build into an unrecoverable dependency-resolution failure.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 357e8a8 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[datadog-prod-us1-5]

Treat blank proxy values as absent

CI or external builds that export an unset optional proxy variable as an empty string can fail all general dependency resolution before tests run.

Assertion details

• Input: MAVEN_REPOSITORY_PROXY or ORG_GRADLE_PROJECT_mavenRepositoryProxy is present but empty or whitespace-only, such as when shell setup exports an undefined variable.
• Expected: Normalize both proxy values before repository selection and treat blank or whitespace-only values as absent, retaining Maven Central. This requires coordinated changes in both changed files and coverage for blank environment/property values, so no single inline suggestion is complete.
• Actual: Both changed paths use presence-only checks. An empty MAVEN_REPOSITORY_PROXY now produces only an empty proxy repository, while a present-but-empty Gradle property suppresses mavenCentral(); clean dependency resolution therefore has no usable general repository. Existing tests cover non-empty fixture proxies but not blank default-repository selection.

Was this helpful? React 👍 or 👎
_{🤖 Datadog Autotest · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[AlexeyKuznetsov-DD]

Closing this, since infra fixed network configuration that should prevent rate-limiting on Maven Central.
Several latest pipelines passed on master and PRs for last 3 days without rate limiting.