Keep Maven Central out of Renovate's lookup path

[rubensworks]

Follow-up to the same fix in packtests#73, infobook-html#54, infobook-html-evilcraft#11 and infobook-html-integrateddynamics#20.

Why this repo is affected

It is not obvious, because no pom here declares Maven Central. Every pom declares only https://maven.pkg.github.com/CyclopsMC/packages. Central gets added anyway:

• modules/manager/maven/extract.js, cleanResult (line 353 in 44.82.3) pushes MAVEN_REPO onto every Maven dep's registryUrls, unconditionally.
• modules/datasource/maven/index.js sets registryStrategy = "merge", so every registry in that list is queried for every dep.
• modules/datasource/maven/util.js turns a 429 or 5xx specifically from Central's host into maven-central-temporary-error and throws it as an ExternalHostError (line 150).
• workers/repository/error.js logs External host error causing abort - skipping for an ExternalHostError that reaches it.

So Central is queried 150 times per run here purely to 404, and its rate limiting can abort the run.

Changes

1. packageRules with registryUrls, pinning each groupId to the registry that actually serves it. Every active dependency in this repo is org.cyclops.*, so there is one rule that matters, mapping it to GitHub Packages. Two extra rules cover the mekanism and com.refinedmods.refinedstorage deps that are currently commented out in the poms, so re-enabling them does not reintroduce a Central lookup.
2. A hostRules entry for repo.maven.apache.org. This does not work and is not a safety net, see the caveat below. It carries an in-file description saying so.
3. The config migration Renovate reports: "matchPackagePrefixes": ["org.cyclops."] becomes "matchPackageNames": ["org.cyclops.{/,}**"].

Nothing else changes. The config:recommended preset, enabledManagers, both automerge rules, the Cyclops packages groupName, and the RENOVATE_GITHUB_COM_TOKEN hostRule are untouched.

Caveat on the hostRule, please do not mistake it for protection

{"abortOnError": false, "abortIgnoreStatusCodes": [429]} is a no-op. In util/http/http.js:

if (abortOnError && !abortIgnoreStatusCodes?.includes(err.statusCode)) throw new ExternalHostError(err);

abortOnError is already falsy by default, so setting it to false changes nothing, and abortIgnoreStatusCodes is only consulted when abortOnError is true. More importantly, the abort does not come through that path at all: it comes from the Maven datasource's own unconditional Central special case in modules/datasource/maven/util.js, which no hostRule suppresses. It is included only for consistency with the four sibling repos.

The mechanism that would give a hard guarantee is:

{"matchHost": "repo.maven.apache.org", "enabled": false}

A disabled host raises a plain host-disabled error, which the Maven datasource classifies as unknown and swallows. I have deliberately not added this, because its failure mode is silent: any dep that genuinely needed Central would just stop updating with no signal. Raising it as an option, not applying it unilaterally.

One correction to the stated root cause

The mergeRegistries behaviour is milder in current Renovate than in the original diagnosis. In 44.82.3 (modules/datasource/index.js) an ExternalHostError from one registry is caught, logged as datasource merge: external host error from registry; continuing so releases from other registries are not discarded, and the loop continues. It is rethrown only if no registry returned any releases:

if (!combinedRes) {
  if (externalHostError) throw externalHostError;
  ...
}

I bisected this across published versions: 44.0.0, 44.10.0, 44.20.0 and 44.30.0 rethrow unconditionally; 44.35.0 and later have the continue. So on a recent Renovate the abort needs Central to error and the GitHub Packages lookup to come up empty for at least one dep, rather than Central erroring alone. That narrows the window but does not close it, and it depends on which version Mend is running, which I cannot see from here. This change removes the exposure regardless of version, and also stops 150 pointless requests to Central per run.

postprocessRelease is not an additional abort path: modules/datasource/postprocess-release.js catches everything and returns the release unchanged.

Not an org-level config

Worth stating since this is the .github repo. This renovate.json is this repo's own config only, not an org default that other CyclopsMC repos inherit. Renovate's inherited config is a self-hosted admin setting: inheritConfig is globalOnly and defaults to false, and it reads org-inherited-config.json from {{parentOrg}}/renovate-config, not renovate.json from .github. So this fix has to be per-repo, which matches the four sibling PRs.

Validation

• npx --yes --package renovate -- renovate-config-validator --strict from the repo root, no path argument. Before: exit 1, WARN: Config migration necessary. After: exit 0, INFO: Config validated successfully.
• Every mapped coordinate fetched with curl -sSL, exact .pom for the version in the repo:
  • modmaven.dev mekanism:Mekanism:1.21.1-10.7.17.83 -> 200
  • maven.creeperhost.net com.refinedmods.refinedstorage:refinedstorage-neoforge:3.2.0 -> 200
  • repo.maven.apache.org for org.cyclops.cyclopscore:cyclopscore-26.2-neoforge:1.30.0-1038 -> 404, confirming Central does not serve these
  • GitHub Packages is unverified. maven.pkg.github.com returns 401 for these poms without a token, so I could not confirm 200 for the org.cyclops.* mapping. It is inferred from the <repositories> block every pom already declares and from the existing RENOVATE_GITHUB_COM_TOKEN hostRule, not measured.
• Glob patterns checked against Renovate's own matcher, matchRegexOrGlobList from dist/util/string-match.js, over all 150 active groupId:artifactId pairs extracted from the 13 poms. Each matches exactly one registry rule, none double-matches, and the migrated org.cyclops.{/,}** glob matches exactly the same set the old matchPackagePrefixes did, so the Cyclops packages grouping is unchanged. The two commented-out coordinates also resolve to one rule each.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MahadNA3gehFpLYemERXRn

---

Generated by Claude Code