Route CI Maven resolution through Databricks proxy

Maven Central is blocked on Databricks network (including GH Actions
runners). Add proxy mirror config to all CI workflows so dependency
resolution goes through maven-proxy.dev.databricks.com.

For the release workflow, a Python script injects the mirror into the
settings.xml that setup-java creates (to preserve server credentials).

Co-authored-by: Isaac

Author: simonfaltum

.github/inject-maven-mirror.py

@@ -0,0 +1,46 @@
+"""Inject Databricks Maven proxy mirror into an existing settings.xml.
+
+If no settings.xml exists at the given path, copies the default from
+.github/maven-settings.xml instead.
+"""
+import sys
+import xml.etree.ElementTree as ET
+from pathlib import Path
+
+MIRROR_XML = """\
+  <mirror>
+    <id>databricks-maven-proxy</id>
+    <mirrorOf>central</mirrorOf>
+    <url>https://maven-proxy.dev.databricks.com</url>
+  </mirror>"""
+
+settings_path = Path(sys.argv[1])
+
+if not settings_path.exists():
+    # No existing settings, just copy the default
+    default = Path(__file__).parent / "maven-settings.xml"
+    settings_path.parent.mkdir(parents=True, exist_ok=True)
+    settings_path.write_text(default.read_text())
+    print(f"Copied default maven-settings.xml to {settings_path}")
+    sys.exit(0)
+
+# Parse existing settings and inject mirror
+tree = ET.parse(settings_path)
+root = tree.getroot()
+
+# Handle Maven namespace
+ns = ""
+if root.tag.startswith("{"):
+    ns = root.tag.split("}")[0] + "}"
+
+mirrors = root.find(f"{ns}mirrors")
+if mirrors is None:
+    mirrors = ET.SubElement(root, "mirrors")
+
+mirror = ET.SubElement(mirrors, "mirror")
+ET.SubElement(mirror, "id").text = "databricks-maven-proxy"
+ET.SubElement(mirror, "mirrorOf").text = "central"
+ET.SubElement(mirror, "url").text = "https://maven-proxy.dev.databricks.com"
+
+tree.write(settings_path, xml_declaration=True, encoding="UTF-8")
+print(f"Injected Maven proxy mirror into {settings_path}")

.github/maven-settings.xml

@@ -0,0 +1,9 @@
+<settings>
+  <mirrors>
+    <mirror>
+      <id>databricks-maven-proxy</id>
+      <mirrorOf>central</mirrorOf>
+      <url>https://maven-proxy.dev.databricks.com</url>
+    </mirror>
+  </mirrors>
+</settings>

.github/workflows/push.yml

@@ -18,6 +18,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
+      - name: Configure Maven proxy
+        run: mkdir -p ~/.m2 && cp .github/maven-settings.xml ~/.m2/settings.xml
+
       - name: Cache Maven packages
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
@@ -46,6 +49,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
+      - name: Configure Maven proxy
+        run: mkdir -p ~/.m2 && cp .github/maven-settings.xml ~/.m2/settings.xml
+
       - name: Cache Maven packages
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
@@ -67,5 +73,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
+      - name: Configure Maven proxy
+        run: mkdir -p ~/.m2 && cp .github/maven-settings.xml ~/.m2/settings.xml
+
       - name: Validate lockfile
         run: make check-lock

.github/workflows/release.yml

@@ -32,7 +32,10 @@ jobs:
           server-password: MAVEN_CENTRAL_PASSWORD
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: GPG_PASSPHRASE
-          
+
+      - name: Configure Maven proxy
+        run: python3 .github/inject-maven-mirror.py ~/.m2/settings.xml
+
       # This step runs ONLY on branch pushes (dry-run)
       - name: Run Release Dry-Run (Verify)
         if: "!startsWith(github.ref, 'refs/tags/')"