ci: resolve Maven Central through Google's mirror

.github/actions/chen-from-main/action.yml

@@ -15,6 +15,18 @@ inputs:
 runs:
   using: composite
   steps:
+    # Repositories for the sbt launcher are steered by COURSIER_REPOSITORIES in the calling
+    # workflows, which lists GitHub Packages; coursier needs its own credentials file to
+    # authenticate against it, independent of the sbt-github-packages plugin.
+    - name: Coursier credentials for GitHub Packages
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+        dir="${COURSIER_CONFIG_DIR:-$HOME/.config/coursier}"
+        mkdir -p "$dir"
+        printf 'maven.pkg.github.com x-access-token %s\n' "$GITHUB_TOKEN" > "$dir/credentials.properties"
     - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961  # v5.7.0
       if: inputs.setup-jdk == 'true'
       with:

.github/workflows/container-tests.yml

@@ -7,6 +7,12 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+  # Google's mirror of Maven Central first, repo1 and every resolver the build declares as
+  # fallbacks (Maven Central is rate-limited from CI); drives the sbt launcher too. chen-from-main
+  # writes the GitHub Packages credentials coursier needs for the last entry. Coursier requires
+  # pipe-separated entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 jobs:
   lang-container-tests:
     strategy:

.github/workflows/containers.yml

@@ -16,6 +16,11 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
+  # Google's mirror of Maven Central first, repo1 and every resolver the build declares as
+  # fallbacks (Maven Central is rate-limited from CI); drives the sbt launcher too. chen-from-main
+  # writes the GitHub Packages credentials coursier needs for the last entry. Coursier requires
+  # pipe-separated entries - a ';' separator or unknown alias makes it ignore the whole list.
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
   IMAGE_NAME: appthreat/atom
 
 jobs:

.github/workflows/nodejstests.yml

@@ -7,6 +7,14 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+# Google's mirror of Maven Central first, with repo1 and every resolver the build declares
+# (see build.sbt) as fallbacks: Maven Central is rate-limited/flaky from CI - the sbt launcher
+# itself failed to download org.scala-sbt:sbt while the artifact existed. This drives the sbt
+# launcher as well as the build's dependency resolution. chen-from-main writes the GitHub
+# Packages credentials coursier needs for the last entry. Coursier requires pipe-separated
+# entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 
 jobs:
   lang-testing:

.github/workflows/pr.yml

@@ -11,6 +11,14 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+# Google's mirror of Maven Central first, with repo1 and every resolver the build declares
+# (see build.sbt) as fallbacks: Maven Central is rate-limited/flaky from CI - the sbt launcher
+# itself failed to download org.scala-sbt:sbt while the artifact existed. This drives the sbt
+# launcher as well as the build's dependency resolution. chen-from-main writes the GitHub
+# Packages credentials coursier needs for the last entry. Coursier requires pipe-separated
+# entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 
 jobs:
   # The unit tests and distribution build on the other operating systems, so a merge cannot

.github/workflows/release.yml

@@ -10,6 +10,11 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
+  # Google's mirror of Maven Central first, repo1 and every resolver the build declares as
+  # fallbacks (Maven Central is rate-limited from CI); drives the sbt launcher too. chen-from-main
+  # writes the GitHub Packages credentials coursier needs for the last entry. Coursier requires
+  # pipe-separated entries - a ';' separator or unknown alias makes it ignore the whole list.
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
   IMAGE_NAME: appthreat/atom
 jobs:
   release-win:

.github/workflows/repotests.yml

@@ -11,6 +11,14 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
+# Google's mirror of Maven Central first, with repo1 and every resolver the build declares
+# (see build.sbt) as fallbacks: Maven Central is rate-limited/flaky from CI - the sbt launcher
+# itself failed to download org.scala-sbt:sbt while the artifact existed. This drives the sbt
+# launcher as well as the build's dependency resolution. chen-from-main writes the GitHub
+# Packages credentials coursier needs for the last entry. Coursier requires pipe-separated
+# entries - a ';' separator or unknown alias makes it ignore the whole list.
+env:
+  COURSIER_REPOSITORIES: "ivy2Local|https://maven-central.storage-download.googleapis.com/maven2|https://repo1.maven.org/maven2|https://maven.google.com|https://oss.sonatype.org/content/repositories/public|https://packages.atlassian.com/mvn/maven-atlassian-external|https://repo.gradle.org/gradle/libs-releases|https://maven.pkg.github.com/appthreat/chen"
 
 jobs:
   jvm-testing:

build.sbt

@@ -6,7 +6,12 @@ ThisBuild / scalaVersion := "3.9.0"
 val chenVersion = "4.0.0"
 
 lazy val atom = Projects.atom
-resolvers += "Google Maven".at("https://maven.google.com/")
+resolvers ++= Seq(
+  // Google's mirror of Maven Central: resolves the same artifacts without repo1's rate
+  // limiting, which has made CI builds fail while the artifact demonstrably existed.
+  "gcs-maven-central-mirror".at("https://maven-central.storage-download.googleapis.com/maven2"),
+  "Google Maven".at("https://maven.google.com/")
+)
 libraryDependencies ++= Seq(
   "com.github.pathikrit" %% "better-files" % "3.9.2",
   "com.github.scopt"     %% "scopt"        % "4.1.0",