feat: add fallback for google maven (CM-1299) (#4275)

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

services/apps/packages_worker/src/maven/__tests__/registry.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, it } from 'vitest'
 
-import { resolveRegistryBaseUrl, resolveRegistryPageUrl } from '../registry'
+import {
+  MAVEN_CENTRAL_BASE_URL,
+  resolveRegistryBaseUrl,
+  resolveRegistryPageUrl,
+  resolveRegistryPageUrlFromBase,
+} from '../registry'
 
 describe('resolveRegistryBaseUrl', () => {
   it('returns Google Maven for androidx namespace', () => {
@@ -15,8 +20,15 @@ describe('resolveRegistryBaseUrl', () => {
     )
   })
 
-  it('returns Maven Central for bare com.google.android (legacy SDK stubs on Central)', () => {
-    expect(resolveRegistryBaseUrl('com.google.android')).toBe('https://repo1.maven.org/maven2')
+  it('returns Google Maven for bare com.google.android (legacy Android SDK stubs)', () => {
+    expect(resolveRegistryBaseUrl('com.google.android')).toBe(
+      'https://dl.google.com/dl/android/maven2',
+    )
+  })
+
+  it('does not match com.google.androidx — prefix boundary must end at a dot', () => {
+    // com.google.android prefix must not bleed into unrelated com.google.android* strings
+    expect(resolveRegistryBaseUrl('com.google.androidx')).toBe(MAVEN_CENTRAL_BASE_URL)
   })
 
   it('returns Google Maven for android.arch (pre-AndroidX Architecture Components)', () => {
@@ -163,3 +175,22 @@ describe('resolveRegistryPageUrl', () => {
     )
   })
 })
+
+describe('resolveRegistryPageUrlFromBase', () => {
+  it('returns Sonatype Central URL when resolvedBaseUrl is Maven Central', () => {
+    expect(
+      resolveRegistryPageUrlFromBase(
+        'com.google.firebase',
+        'firebase-admin',
+        MAVEN_CENTRAL_BASE_URL,
+      ),
+    ).toBe('https://central.sonatype.com/artifact/com.google.firebase/firebase-admin')
+  })
+
+  it('returns alternative registry page URL when resolvedBaseUrl is not Central', () => {
+    const googleMavenUrl = 'https://dl.google.com/dl/android/maven2'
+    expect(
+      resolveRegistryPageUrlFromBase('com.google.firebase', 'firebase-analytics', googleMavenUrl),
+    ).toBe('https://maven.google.com/web/index.html#com.google.firebase:firebase-analytics')
+  })
+})

services/apps/packages_worker/src/maven/registry.ts

@@ -11,7 +11,7 @@
  * metadata.xml / POM fetch logic works — only the base URL changes.
  */
 
-const MAVEN_CENTRAL_BASE_URL = 'https://repo1.maven.org/maven2'
+export const MAVEN_CENTRAL_BASE_URL = 'https://repo1.maven.org/maven2'
 
 interface RegistryEntry {
   prefix: string
@@ -25,10 +25,10 @@ const ALTERNATIVE_REGISTRIES: RegistryEntry[] = [
     baseUrl: 'https://dl.google.com/dl/android/maven2',
     pageUrl: (g, a) => `https://maven.google.com/web/index.html#${g}:${a}`,
   },
-  // com.google.android (bare, no sub-namespace) are legacy SDK stubs on Maven Central —
-  // only sub-namespaces like com.google.android.gms.* live on Google Maven.
+  // com.google.android — all artifacts (bare namespace and sub-namespaces like
+  // com.google.android.gms.*) are on Google Maven, not Maven Central.
   {
-    prefix: 'com.google.android.',
+    prefix: 'com.google.android',
     baseUrl: 'https://dl.google.com/dl/android/maven2',
     pageUrl: (g, a) => `https://maven.google.com/web/index.html#${g}:${a}`,
   },
@@ -137,7 +137,9 @@ const ALTERNATIVE_REGISTRIES: RegistryEntry[] = [
 ]
 
 function findEntry(groupId: string): RegistryEntry | undefined {
-  return ALTERNATIVE_REGISTRIES.find((r) => groupId.startsWith(r.prefix))
+  return ALTERNATIVE_REGISTRIES.find(
+    (r) => groupId === r.prefix || groupId.startsWith(r.prefix + '.'),
+  )
 }
 
 /**
@@ -154,6 +156,16 @@ export function resolveRegistryBaseUrl(groupId: string): string {
   return process.env.MAVEN_FETCHER_BASE_URL ?? MAVEN_CENTRAL_BASE_URL
 }
 
+/**
+ * Returns true when the given groupId maps to a non-Central registry.
+ * Used in the enrichment loop to decide whether a Central fallback lookup is worth trying
+ * (e.g. com.google.firebase:firebase-admin is a server-side Java SDK on Central, while
+ * most com.google.firebase artifacts are Android SDKs on Google Maven).
+ */
+export function isAlternativeRegistry(groupId: string): boolean {
+  return findEntry(groupId) !== undefined
+}
+
 /**
  * Returns a human-browsable URL for the given artifact in its authoritative registry.
  */
@@ -162,3 +174,23 @@ export function resolveRegistryPageUrl(groupId: string, artifactId: string): str
   if (entry) return entry.pageUrl(groupId, artifactId)
   return `https://central.sonatype.com/artifact/${groupId}/${artifactId}`
 }
+
+/**
+ * Like resolveRegistryPageUrl, but uses the resolved base URL to determine which
+ * registry page to show. When the artifact was actually fetched from Maven Central
+ * (e.g. via the Central fallback after the primary alternative registry 404'd), the
+ * namespace-based routing would point at the wrong registry page — this overrides it.
+ */
+export function resolveRegistryPageUrlFromBase(
+  groupId: string,
+  artifactId: string,
+  resolvedBaseUrl: string,
+): string {
+  const isCentral =
+    resolvedBaseUrl === MAVEN_CENTRAL_BASE_URL ||
+    resolvedBaseUrl === process.env.MAVEN_FETCHER_BASE_URL
+  if (isCentral) {
+    return `https://central.sonatype.com/artifact/${groupId}/${artifactId}`
+  }
+  return resolveRegistryPageUrl(groupId, artifactId)
+}

services/apps/packages_worker/src/maven/runMavenEnrichmentLoop.ts

@@ -18,7 +18,13 @@ import { getMavenConfig } from '../config'
 import { extractArtifact, getPomCacheStats, normalizeScmUrl } from './extract'
 import { isMavenFetchError, resolveVersionsList } from './metadata'
 import { isPrerelease, parseRepoUrl } from './normalize'
-import { resolveRegistryBaseUrl, resolveRegistryPageUrl } from './registry'
+import {
+  MAVEN_CENTRAL_BASE_URL,
+  isAlternativeRegistry,
+  resolveRegistryBaseUrl,
+  resolveRegistryPageUrl,
+  resolveRegistryPageUrlFromBase,
+} from './registry'
 
 const log = getServiceChildLogger('maven')
 
@@ -115,10 +121,25 @@ async function processCriticalPackage(qx: QueryExecutor, pkg: PackageRow, forceF
     return { status: 'skipped' }
   }
 
-  const baseUrl = resolveRegistryBaseUrl(groupId)
+  let baseUrl = resolveRegistryBaseUrl(groupId)
 
   // Phase 1: lightweight metadata fetch to get the current upstream version.
-  const metadata = await resolveVersionsList(groupId, artifactId, baseUrl)
+  let metadata = await resolveVersionsList(groupId, artifactId, baseUrl)
+
+  // If the primary (non-Central) registry returned NOT_FOUND, try Maven Central as a
+  // fallback. This handles artifacts that share a namespace with non-Central packages but
+  // are themselves published on Central — e.g. com.google.firebase:firebase-admin is the
+  // server-side Java SDK on Central, while most com.google.firebase artifacts are Android
+  // SDKs on Google Maven.
+  if (isMavenFetchError(metadata) && metadata.kind === 'NOT_FOUND' && isAlternativeRegistry(groupId)) {
+    const centralUrl = process.env.MAVEN_FETCHER_BASE_URL ?? MAVEN_CENTRAL_BASE_URL
+    const centralMetadata = await resolveVersionsList(groupId, artifactId, centralUrl)
+    if (!isMavenFetchError(centralMetadata)) {
+      log.info({ groupId, artifactId }, 'Not found in primary registry — resolved via Maven Central fallback')
+      baseUrl = centralUrl
+      metadata = centralMetadata
+    }
+  }
 
   if (isMavenFetchError(metadata)) {
     if (metadata.kind === 'NOT_FOUND') {
@@ -129,7 +150,7 @@ async function processCriticalPackage(qx: QueryExecutor, pkg: PackageRow, forceF
         name: artifactId,
         description: null,
         homepage: null,
-        registryUrl: resolveRegistryPageUrl(groupId, artifactId),
+        registryUrl: resolveRegistryPageUrlFromBase(groupId, artifactId, baseUrl),
         declaredRepositoryUrl: null,
         repositoryUrl: null,
         licenses: null,
@@ -164,7 +185,7 @@ async function processCriticalPackage(qx: QueryExecutor, pkg: PackageRow, forceF
       name: artifactId,
       description: null,
       homepage: null,
-      registryUrl: resolveRegistryPageUrl(groupId, artifactId),
+      registryUrl: resolveRegistryPageUrlFromBase(groupId, artifactId, baseUrl),
       declaredRepositoryUrl: null,
       repositoryUrl: null,
       licenses: null,
@@ -201,7 +222,7 @@ async function processCriticalPackage(qx: QueryExecutor, pkg: PackageRow, forceF
       name: artifactId,
       description: null,
       homepage: null,
-      registryUrl: resolveRegistryPageUrl(groupId, artifactId),
+      registryUrl: resolveRegistryPageUrlFromBase(groupId, artifactId, baseUrl),
       declaredRepositoryUrl: null,
       repositoryUrl: null,
       licenses: null,
@@ -227,7 +248,7 @@ async function processCriticalPackage(qx: QueryExecutor, pkg: PackageRow, forceF
         name: artifactId,
         description: result.description,
         homepage: result.homepageUrl,
-        registryUrl: resolveRegistryPageUrl(groupId, artifactId),
+        registryUrl: resolveRegistryPageUrlFromBase(groupId, artifactId, baseUrl),
         declaredRepositoryUrl: result.scmUrl,
         repositoryUrl,
         licenses: result.licenses.length > 0 ? result.licenses : null,