From 38f41aa29d107870e59e55ff320dd473892b94ee Mon Sep 17 00:00:00 2001
From: Brandon McAnsh <git@bmcreations.dev>
Date: Fri, 28 Aug 2026 11:18:14 -0400
Subject: [PATCH] fix(build): scope JitPack to its own coordinate namespaces

Five Dependabot PRs went red at once with the same configuration-phase
failure:

    > Could not resolve org.gradle:gradle-tooling-api:5.2.1
      Required by: buildscript of root project 'Flipcash'
                   > com.ahasbini.tools:android-opencv-gradle-plugin:0.1.3-dev
      > Could not GET 'https://jitpack.io/org/gradle/gradle-tooling-api/5.2.1/...'
         > Read timed out

`gradle-tooling-api` is only published to repo.gradle.org, which the
buildscript already declares. The problem is ordering: JitPack sits ahead
of it and is queried for every artifact, and a read timeout aborts
resolution instead of falling through to the next repository the way a
404 does. So a JitPack blip fails the build before the artifact is looked
for where it actually lives.

Restrict all three JitPack declarations to the com.github, com.gitlab and
com.bitbucket namespaces JitPack serves. Nothing in the build resolves
from JitPack today: the OpenCV plugin comes from gradlePluginPortal, and
every other non-Central group resolves from Central, Google or
maven.fpregistry.io. Keeping the repository declared but filtered leaves
a JitPack-style dependency working without putting JitPack in the path of
everything else.

Verified with forced-refresh resolution against the network:
`buildEnvironment` resolves the plugin and its transitive
gradle-tooling-api, and `:apps:flipcash:app:dependencies` resolves the
debug runtime classpath with no failures.
---
 build.gradle.kts    | 12 +++++++++++-
 settings.gradle.kts | 16 ++++++++++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index 9820a5187..01bd0c750 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -3,7 +3,17 @@ buildscript {
         google()
         mavenCentral()
         gradlePluginPortal()
-        maven(url = "https://jitpack.io")
+        // JitPack only ever serves its own coordinate namespaces. Without this filter it
+        // is queried for every artifact, and because it sits ahead of repo.gradle.org a
+        // transient JitPack timeout fails the build before the tooling API is ever looked
+        // for where it actually lives.
+        maven(url = "https://jitpack.io") {
+            content {
+                includeGroupByRegex("com\\.github\\..*")
+                includeGroupByRegex("com\\.gitlab\\..*")
+                includeGroupByRegex("com\\.bitbucket\\..*")
+            }
+        }
         maven(url = "https://repo.gradle.org/gradle/libs-releases")
     }
 
diff --git a/settings.gradle.kts b/settings.gradle.kts
index a6319df72..8d0c2b498 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -7,7 +7,13 @@ pluginManagement {
         google()
         mavenCentral()
         gradlePluginPortal()
-        maven(url = "https://jitpack.io")
+        maven(url = "https://jitpack.io") {
+            content {
+                includeGroupByRegex("com\\.github\\..*")
+                includeGroupByRegex("com\\.gitlab\\..*")
+                includeGroupByRegex("com\\.bitbucket\\..*")
+            }
+        }
     }
     resolutionStrategy {
         eachPlugin {
@@ -59,7 +65,13 @@ dependencyResolutionManagement {
         mavenCentral()
         maven(url = "https://plugins.gradle.org/m2/")
         maven(url = "https://maven.fpregistry.io/releases")
-        maven(url = "https://jitpack.io")
+        maven(url = "https://jitpack.io") {
+            content {
+                includeGroupByRegex("com\\.github\\..*")
+                includeGroupByRegex("com\\.gitlab\\..*")
+                includeGroupByRegex("com\\.bitbucket\\..*")
+            }
+        }
         maven(url = "https://central.sonatype.com/repository/maven-snapshots/")
     }
 }