From db064ba8b859fc81b96b1efa3e240adc81dbcd18 Mon Sep 17 00:00:00 2001
From: JohnBraham <johnbraham1978@outlook.com>
Date: Wed, 26 Aug 2026 23:03:40 +0100
Subject: [PATCH] Isolate staged OreSpawn dependency resolution

---
 build.gradle                                  | 41 +++++++++----------
 .../mc/mineralogy/WorkflowContractTest.java   |  9 ++++
 2 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/build.gradle b/build.gradle
index 54b59dad0..091365ffc 100644
--- a/build.gradle
+++ b/build.gradle
@@ -119,38 +119,35 @@ tasks.withType(JavaExec).configureEach { JavaExec runTask ->
     if (launchTarget != null) configureForge31Run(runTask, launchTarget)
 }
 
-def curseMavenRepository
+def orespawnModule = "mmd-orespawn-${project.orespawn_curse_project_id}"
+def orespawnVerificationRepository = project.findProperty('orespawnVerificationRepository')
 repositories {
     minecraft.mavenizer(it)
     maven fg.forgeMaven
     maven fg.minecraftLibsMaven
     mavenCentral()
-    if (project.hasProperty('orespawnVerificationRepository')) {
-        maven {
-            name = 'OreSpawnReleaseVerificationMirror'
-            url = uri(project.property('orespawnVerificationRepository'))
-            metadataSources { artifact() }
+
+    // The staged CI mirror is the only permitted source for this exact
+    // OreSpawn module. Without exclusive routing, a transient HTTP error from
+    // Maven Central aborts resolution before Gradle reaches the verified jar.
+    exclusiveContent {
+        forRepository {
+            maven {
+                name = orespawnVerificationRepository == null
+                        ? 'CurseMaven'
+                        : 'OreSpawnReleaseVerificationMirror'
+                url = orespawnVerificationRepository == null
+                        ? uri('https://www.cursemaven.com')
+                        : uri(orespawnVerificationRepository)
+                metadataSources { artifact() }
+            }
         }
-    }
-    else {
-        curseMavenRepository = maven {
-            name = 'CurseMaven'
-            url = 'https://www.cursemaven.com'
-            metadataSources { artifact() }
+        filter {
+            includeModule('curse.maven', orespawnModule)
         }
     }
 }
 
-// Keep CurseMaven after ForgeGradle's generated repositories. The released
-// numeric CurseForge coordinate still resolves normally, while Forge's own
-// mapped artifacts remain authoritative for the development environment.
-afterEvaluate {
-    if (curseMavenRepository != null) {
-        repositories.remove(curseMavenRepository)
-        repositories.add(curseMavenRepository)
-    }
-}
-
 configurations {
     orespawnRelease
 }
diff --git a/src/test/java/zone/moddev/mc/mineralogy/WorkflowContractTest.java b/src/test/java/zone/moddev/mc/mineralogy/WorkflowContractTest.java
index 71e265d05..ce25ba0e6 100644
--- a/src/test/java/zone/moddev/mc/mineralogy/WorkflowContractTest.java
+++ b/src/test/java/zone/moddev/mc/mineralogy/WorkflowContractTest.java
@@ -80,6 +80,15 @@ public void buildPublishesOnlyThePreparedRemoteBundle() throws Exception {
         assertFalse(build.contains("file:///${project.projectDir}/mcmodsrepo"));
     }
 
+    @Test
+    public void stagedOreSpawnDependencyCannotFallThroughToPublicRepositories() throws Exception {
+        String build = text("build.gradle");
+        assertTrue(build.contains("exclusiveContent"));
+        assertTrue(build.contains("forRepository"));
+        assertTrue(build.contains("includeModule('curse.maven', orespawnModule)"));
+        assertTrue(build.contains("'OreSpawnReleaseVerificationMirror'"));
+    }
+
     private static String text(String path) throws Exception {
         return new String(Files.readAllBytes(new File(path).toPath()), StandardCharsets.UTF_8)
                 .replace("\r\n", "\n").replace('\r', '\n');