BUILD-11784 Route the Gradle buildscript classpath through Repox in config-gradle

[saberduck]

Problem

config-gradle's Repox init script rewrites repositories to authenticated Repox for pluginManagement, dependencyResolutionManagement, and each project's dependency repositories — but not the buildscript {} classpath.

• A project with a buildscript { dependencies { classpath(...) } } block resolves that classpath (and transitives, e.g. the Kotlin DSL stdlib) from the Gradle Plugin Portal / Maven Central.
• Those are rate-limited and return HTTP 429 on shared CI runners. This already broke sonar-rust-enterprise CI (org.tukaani:xz → kotlin-stdlib).

Change

• Inside the existing allprojects { ... } block, also configure the buildscript classpath repositories via the existing configureRepoxRepositories helper.
• One call added in both beforeEvaluate and afterEvaluate.
• The buildscript {} classpath is resolved during build-script evaluation, so injecting Repox in beforeEvaluate lands it ahead of any repo the script declares — keeping buildscript/plugin classpath deps off the rate-limited public repos. afterEvaluate is kept for parity with the existing project-repos handling.

Impact

• Shared CI action: once merged and tagged (@v1), it affects every repo consuming config-gradle and makes any per-repo buildscript-Repox workaround redundant on CI.

Resolves BUILD-11784.

[hashicorp-vault-sonar-prod]

BUILD-11784

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved

Routes the Gradle buildscript classpath through Repox to prevent rate-limiting on CI runners. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[saberduck]

Validated end-to-end on real CI via test PR SonarSource/sonar-rust-enterprise#26.

That PR deletes sonar-rust-enterprise's per-repo sonar.repo-conventions plugin (its only buildscript-classpath Repox workaround) and pins the Gradle actions to this branch, so CI's sole repository wiring is the repoxAuth init script from this PR.

Result — run #28382069572, all jobs green:

• Buildscript classpath resolves through Repox. With the module cache wiped (rm -rf .../caches/modules-2) and --refresh-dependencies --info, the buildscript deps are downloaded fresh from Repox — not served from cache:

  Added 'Repox' repository: 'https://repox.jfrog.io/artifactory/sonarsource'
  Downloading https://repox.jfrog.io/.../org/tukaani/xz/1.12/xz-1.12.jar ...
  Downloading https://repox.jfrog.io/.../org/jetbrains/kotlin/kotlin-stdlib/2.3.21/kotlin-stdlib-2.3.21.pom ...
  

• Zero public-repo traffic. Downloads grouped by host: 222 → repox.jfrog.io, 0 → public (lone non-Repox hit is the gradle-9.6.0-bin.zip distribution). No repo1.maven.org, no plugins.gradle.org, no HTTP 429. The Kotlin DSL stdlib — the exact transitive that broke sonar-rust-enterprise CI — now comes from Repox.
• A private sonarsource Repox repo served the bytes, so Bearer auth is correctly applied to the buildscript scope too.

The test PR is not for merge — it removes the credential-less local-dev fallback and carries throwaway logging instrumentation.