[build] Restrict Maven authentication to mirror seeding

[jonathanpeppers]

PR #11711 centralized Gradle repository configuration, but applying the Azure Artifacts credential provider during ordinary builds caused authentication dialogs for local developers. CI does not need that provider because it reads packages already cached in dotnet-public-maven anonymously.

This keeps repository selection and authentication as separate controls:

• RUNNINGONCI=true selects dotnet-public-maven for Azure DevOps builds.
• ANDROID_MIRROR_MAVEN_DEPENDENCIES=true loads the credential provider only while mirror-dependencies.ps1 seeds uncached packages.
• Local builds use Google, Maven Central, and the Gradle Plugin Portal without loading Azure authentication code.

The credential provider is loaded through an applied script so it can be gated dynamically. Gradle cannot resolve a plugin by ID from that script's isolated buildscript classpath, so this context requires its implementation class.

• Useful description of why the change is necessary.
• Links to issues fixed: Follow-up to Centralize Gradle Maven repositories via shared eng/gradle/repositories.gradle #11711
• Unit tests: Configured all four Gradle projects in local, anonymous CI, and authenticated mirror-helper modes.

[Copilot]

Pull request overview

Adjusts the repo’s shared Gradle configuration so Azure Artifacts credential-provider authentication is only loaded on the CI path, avoiding interactive auth prompts during local development while keeping the CI Maven-mirror workflow intact.

Changes:

• Gate Azure Artifacts credential-provider loading behind RUNNINGONCI=true and move it into a shared eng/gradle/credential-provider.gradle.
• Update settings.gradle files to conditionally apply the credential-provider script.
• Normalize CI detection and documentation around RUNNINGONCI, and update the dependency-mirroring helper accordingly.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/CodeGen-Binding/Xamarin.Android.LibraryProjectZip-LibBinding/java/JavaLib/settings.gradle	Conditionally applies shared credential-provider script when RUNNINGONCI=true.
src/r8/settings.gradle	Conditionally applies shared credential-provider script when RUNNINGONCI=true.
src/proguard-android/settings.gradle	Conditionally applies shared credential-provider script when RUNNINGONCI=true.
src/manifestmerger/settings.gradle	Conditionally applies shared credential-provider script when RUNNINGONCI=true.
eng/gradle/plugin-repositories.gradle	Uses RUNNINGONCI to switch plugin repositories; removes always-on AzureArtifacts repo.
eng/gradle/dependency-repositories.gradle	Uses RUNNINGONCI to switch dependency repositories.
eng/gradle/mirror-dependencies.ps1	Sets RUNNINGONCI=true for reproducing CI mirror behavior locally.
eng/gradle/credential-provider.gradle	New shared script that wires up the Azure Artifacts credential provider for the CI path.
.github/instructions/gradle.instructions.md	Updates the documented Gradle pattern and CI/local guidance to match RUNNINGONCI + credential-provider script.

[jonathanpeppers]

I tested applying the plugin by ID from this applied script, but Gradle fails with Plugin with id ... not found. Plugins loaded through an applied script buildscript classpath are not registered for ID lookup, so this context requires the implementation class. I added a comment documenting that constraint. The script itself is now loaded only when ANDROID_MIRROR_MAVEN_DEPENDENCIES=true, which is set exclusively by the mirror helper.