feat: add gradle plugin

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

services/apps/packages_worker/src/maven/__tests__/registry.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 
 import {
+  GRADLE_PLUGIN_PORTAL_BASE_URL,
   MAVEN_CENTRAL_BASE_URL,
   resolveRegistryBaseUrl,
   resolveRegistryPageUrl,
@@ -225,4 +226,14 @@ describe('resolveRegistryPageUrlFromBase', () => {
       resolveRegistryPageUrlFromBase('com.google.firebase', 'firebase-analytics', googleMavenUrl),
     ).toBe('https://maven.google.com/web/index.html#com.google.firebase:firebase-analytics')
   })
+
+  it('returns Gradle Plugin Portal path when resolvedBaseUrl is Gradle Plugin Portal', () => {
+    expect(
+      resolveRegistryPageUrlFromBase(
+        'io.github.trueangle',
+        'gradle-plugin',
+        GRADLE_PLUGIN_PORTAL_BASE_URL,
+      ),
+    ).toBe('https://plugins.gradle.org/m2/io/github/trueangle/gradle-plugin/')
+  })
 })

services/apps/packages_worker/src/maven/metadata.ts

@@ -111,9 +111,12 @@ export async function resolveVersionsList(
     } catch (err) {
       if (axios.isAxiosError(err)) {
         const status = err.response?.status
-        // 404 = standard not-found. 401 = JitPack's response for packages that
-        // don't exist as public builds (JitPack uses 401 instead of 404 here).
-        if (status === 404 || status === 401) return { kind: 'NOT_FOUND' }
+        // 404 = standard not-found. 401 = JitPack-specific: returned for packages
+        // that don't exist as public builds. Scoped to JitPack only — other
+        // registries may return 401 for auth failures, which should not be
+        // silently treated as a missing package.
+        if (status === 404 || (status === 401 && url.includes('jitpack.io')))
+          return { kind: 'NOT_FOUND' }
         // 429 = explicit rate limit, 403 = CDN throttle (Maven Central uses both)
         if ((status === 429 || status === 403) && attempt < MAX_RETRIES) {
           const delay = RETRY_BASE_MS * 2 ** attempt + Math.random() * 500

services/apps/packages_worker/src/maven/registry.ts

@@ -12,6 +12,7 @@
  */
 
 export const MAVEN_CENTRAL_BASE_URL = 'https://repo1.maven.org/maven2'
+export const GRADLE_PLUGIN_PORTAL_BASE_URL = 'https://plugins.gradle.org/m2'
 
 interface RegistryEntry {
   prefix: string
@@ -96,8 +97,8 @@ const ALTERNATIVE_REGISTRIES: RegistryEntry[] = [
   },
   {
     prefix: 'gradle.plugin',
-    baseUrl: 'https://plugins.gradle.org/m2',
-    pageUrl: (g, a) => `https://plugins.gradle.org/m2/${g.replace(/\./g, '/')}/${a}/`,
+    baseUrl: GRADLE_PLUGIN_PORTAL_BASE_URL,
+    pageUrl: (g, a) => `${GRADLE_PLUGIN_PORTAL_BASE_URL}/${g.replace(/\./g, '/')}/${a}/`,
   },
   // JitPack builds and serves artifacts directly from GitHub/GitLab/Bitbucket source repos.
   // The io.github.<username> and com.github.<username> groupId conventions are JitPack-specific
@@ -207,5 +208,8 @@ export function resolveRegistryPageUrlFromBase(
   if (isCentral) {
     return `https://central.sonatype.com/artifact/${groupId}/${artifactId}`
   }
+  if (resolvedBaseUrl === GRADLE_PLUGIN_PORTAL_BASE_URL) {
+    return `${GRADLE_PLUGIN_PORTAL_BASE_URL}/${groupId.replace(/\./g, '/')}/${artifactId}/`
+  }
   return resolveRegistryPageUrl(groupId, artifactId)
 }

services/apps/packages_worker/src/maven/runMavenEnrichmentLoop.ts

@@ -19,6 +19,7 @@ import { extractArtifact, getPomCacheStats, normalizeScmUrl } from './extract'
 import { isMavenFetchError, resolveVersionsList } from './metadata'
 import { isPrerelease, parseRepoUrl } from './normalize'
 import {
+  GRADLE_PLUGIN_PORTAL_BASE_URL,
   MAVEN_CENTRAL_BASE_URL,
   isAlternativeRegistry,
   resolveRegistryBaseUrl,
@@ -141,6 +142,19 @@ async function processCriticalPackage(qx: QueryExecutor, pkg: PackageRow, forceF
     }
   }
 
+  // Third fallback: Gradle Plugin Portal. Plugins can be published under any groupId
+  // (not just gradle.plugin.*), so this is worth trying for all NOT_FOUND packages.
+  // Skip when GPP is already the primary registry (gradle.plugin.*) to avoid a
+  // redundant second call to the same URL.
+  if (isMavenFetchError(metadata) && metadata.kind === 'NOT_FOUND' && baseUrl !== GRADLE_PLUGIN_PORTAL_BASE_URL) {
+    const gradlePortalMetadata = await resolveVersionsList(groupId, artifactId, GRADLE_PLUGIN_PORTAL_BASE_URL)
+    if (!isMavenFetchError(gradlePortalMetadata)) {
+      log.info({ groupId, artifactId }, 'Not found in primary/Central — resolved via Gradle Plugin Portal fallback')
+      baseUrl = GRADLE_PLUGIN_PORTAL_BASE_URL
+      metadata = gradlePortalMetadata
+    }
+  }
+
   if (isMavenFetchError(metadata)) {
     if (metadata.kind === 'NOT_FOUND') {
       await upsertPackage(qx, {