From caba8906f8ab76aa5d6da58afe4f986589cee79d Mon Sep 17 00:00:00 2001
From: Hendrik Brombeer <20863417+hbrombeer@users.noreply.github.com>
Date: Sat, 17 Oct 2026 11:43:57 +0200
Subject: [PATCH] fix(build): resolve dependencies through the runner mirror in
 Docker builds

Mount the runners' Maven mirror init script, which the shared Docker
workflow passes as the BuildKit secret gradle_init, into the Gradle RUN.
Image builds then resolve through the mirror instead of Maven Central,
which has been failing release builds with 429s. Without the secret the
mount is skipped and Gradle resolves from upstream as before.
---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index dce2d0b..5b9c159 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,6 +34,7 @@ COPY velocity/ velocity/
 # fails configuration on an included project with no directory, and the failure
 # names the module rather than the missing COPY.
 RUN --mount=type=secret,id=github_token,required=true \
+    --mount=type=secret,id=gradle_init,target=/root/.gradle/init.d/grounds-maven-mirror.init.gradle.kts,required=false \
     /bin/sh -euc '\
       : "${GITHUB_USER:?GITHUB_USER build arg is required}"; \
       token="$(cat /run/secrets/github_token)"; \