Prevent nested smoke builds from falling back to Maven Central

[AlexeyKuznetsov-DD]

What Does This Do

Prevents nested smoke-test Gradle builds from registering Maven Central when the Maven repository proxy is configured.

Adds end-to-end coverage that verifies the nested plugin-management and project dependency repository lists contain the configured proxy and do not contain Maven Central.

Motivation

GitLab builds are required to resolve Maven artifacts only through Depot. They must not fall back to Maven Central when the Depot proxy is configured.

The root build and build-logic settings already follow this policy, but the init script injected into nested smoke-test builds still registered Maven Central unconditionally. Dynamic dependency resolution could therefore contact Maven Central directly even when Depot was available, exposing GitLab jobs to Maven Central rate limits.

This extends the repository policy introduced in #12403 and #12404 to nested smoke-test builds.

Additional Notes

The GitLab smoke-test failure contained this dependency-resolution stack trace:

Could not determine the dependencies of task ':shadowJar'.
> Could not resolve all dependencies for configuration ':runtimeClasspath'.
   > Could not resolve com.datadoghq:dd-trace-api:+.
      > Failed to list versions for com.datadoghq:dd-trace-api.
         > Unable to load Maven meta-data from https://repo.maven.apache.org/maven2/com/datadoghq/dd-trace-api/maven-metadata.xml.
            > Could not GET 'https://repo.maven.apache.org/maven2/com/datadoghq/dd-trace-api/maven-metadata.xml'.
              Received status code 429 from server: Too Many Requests

Caused by: org.gradle.internal.resource.transport.http.HttpErrorStatusCodeException:
Could not GET 'https://repo.maven.apache.org/maven2/com/datadoghq/dd-trace-api/maven-metadata.xml'.
Received status code 429 from server: Too Many Requests

Validation:

./gradlew -p build-logic :smoke-test:test
./gradlew spotlessKotlinGradleCheck

The build-logic smoke-test suite ran 27 tests with no failures or skips.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: [N/A]

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T22:57:14.483210Z	f70ab11	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-14T22:56:30.302565Z	f70ab11	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1-2]

Nested build scripts can add Maven Central after the init hook. Existing Vert.x and WildFly smoke builds do this, so proxy-only jobs can still send dependency requests to Maven Central.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit f70ab11 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.83 s	14.65 s	[+0.4%; +2.0%] (maybe worse)
startup:insecure-bank:tracing:Agent	13.62 s	13.66 s	[-1.1%; +0.4%] (no difference)
startup:petclinic:appsec:Agent	17.00 s	16.92 s	[-0.4%; +1.4%] (no difference)
startup:petclinic:iast:Agent	17.02 s	16.59 s	[-1.8%; +7.0%] (no difference)
startup:petclinic:profiling:Agent	16.64 s	16.87 s	[-2.3%; -0.4%] (maybe better)
startup:petclinic:sca:Agent	17.01 s	16.77 s	[+0.5%; +2.2%] (maybe worse)
startup:petclinic:tracing:Agent	16.04 s	16.23 s	[-2.3%; -0.1%] (maybe better)

Commit: 2255fe06 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[amarziali]

The init script explicitly adds the proxy, while redirectMavenCentral() also rewrites every subsequent mavenCentral() declaration to that same URL. Consequently, both plugin-management and project repository lists contain the proxy twice. These remain distinct Gradle repositories, potentially duplicating metadata/artifact requests and repository-side effects.

[amarziali]

I left a comment raised by codex as P2. Otherwise lgtm