From ade00b9f71064ac306d7e95c84312f39d6af3eec Mon Sep 17 00:00:00 2001 From: Bradley Duck Date: Fri, 21 Aug 2026 14:53:32 +0100 Subject: [PATCH] fix(ci): make publishing-check resolve only what was just published MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The check listed jitpack.io alongside mavenLocal. Now that 1.8.3 is released, a module that silently failed to publish locally could resolve from the released artifact of the same version instead — so the check would pass having tested the wrong artifact entirely. Demonstrated rather than assumed, by deleting MockInterceptor 1.8.3 from ~/.m2 and running both shapes: with jitpack.io: PASS x4, "resolves cleanly" <- false green without jitpack.io: FAILED, could not find MockInterceptor:1.8.3 Nothing needed the fallback: the toolbox's own modules come from mavenLocal and every third-party dependency resolves from google or mavenCentral, so the check still passes with it removed. Found via the AssistantHood session withdrawing a cache-provenance assertion of its own. The general shape is the one that keeps recurring in this work: a fallback or cached route lets a check succeed for a reason unrelated to what it claims to measure. Here it was worse than a missing assertion, because a green would have actively certified the released artifact as if it were the build's output. Co-Authored-By: Claude Opus 5 (1M context) --- publishing-check/settings.gradle.kts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/publishing-check/settings.gradle.kts b/publishing-check/settings.gradle.kts index a528b97..72aa08f 100644 --- a/publishing-check/settings.gradle.kts +++ b/publishing-check/settings.gradle.kts @@ -6,10 +6,13 @@ // with its own resolution rules and cannot affect how the library itself resolves anything. dependencyResolutionManagement { repositories { + // mavenLocal FIRST and no JitPack repository, deliberately. The point of this check is what + // the toolbox *just published locally*. With JitPack in the list, a module that silently + // failed to publish could resolve from the released artifact of the same version instead + // and the check would pass having tested the wrong thing entirely. mavenLocal() google() mavenCentral() - maven { url = uri("https://jitpack.io") } } }