From b5ea0d2c6b24ec44576226e8e4ceefa230de0484 Mon Sep 17 00:00:00 2001
From: Hendrik Brombeer <20863417+hbrombeer@users.noreply.github.com>
Date: Sat, 17 Oct 2026 11:43:57 +0200
Subject: [PATCH] fix(build): resolve dependencies through the runner mirror in
 Docker builds

Mount the runners' Maven mirror init script, which the shared Docker
workflow passes as the BuildKit secret gradle_init, into the Gradle RUN.
Image builds then resolve through the mirror instead of Maven Central,
which has been failing release builds with 429s. Without the secret the
mount is skipped and Gradle resolves from upstream as before.
---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index 3c5d370..6b0aa82 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,6 +36,7 @@ COPY paper/ paper/
 # `build` task also produces a thin plugin JAR and a sources JAR; the fat one
 # is the one Velocity can actually load.
 RUN --mount=type=secret,id=github_token,required=true \
+    --mount=type=secret,id=gradle_init,target=/root/.gradle/init.d/grounds-maven-mirror.init.gradle.kts,required=false \
     /bin/sh -euc '\
       : "${GITHUB_USER:?GITHUB_USER build arg is required}"; \
       token="$(cat /run/secrets/github_token)"; \