Point TestKit test fixtures at the Code Genome Project

[timtebeek]

Fixes #471.

The main build already resolves org.openrewrite from CGP, but the builds TestKit launches resolved the versions it pinned from Maven Central plus the Sonatype snapshots repository. That works only while rewrite dual-publishes; once it stops publishing snapshots to Sonatype, the pinned version exists in no repository the fixtures know about.

What changed

• Credentials reach the test JVMs. plugin/build.gradle.kts passes codegenomeUsername / codegenomePassword to every Test task as system properties. It uses a CommandLineArgumentProvider with no annotated inputs, so the credentials stay out of the task input fingerprint. CI already exports both as ORG_GRADLE_PROJECT_*, so no workflow change was needed.
• GradleFixtures.REPOSITORIES is credential-aware. With the properties present it emits the credentialed CGP repository; without them it emits today's Maven Central plus Sonatype snapshots, which keeps fork pull requests building. mavenLocal() stays first either way, so a locally published rewrite build still wins.
• Where the Gradle under test can content-filter (5.1+), CGP is scoped to org[.]openrewrite.* and goes ahead of Central. Ordering it after Central left 234 requests in place as 404s in the first run on this branch. The Gradle 4.10 suite has no filtering API, so there CGP goes last instead; putting an unscoped credentialed repository first sent every third-party lookup through it and ran that suite 37% slower.
• All 34 inline blocks now come from the fixture, rendered at the call site's indent so the generated build scripts are byte-identical to what they were. The rendering lives in TestKitRepositories next to GradleProjectSpec, which lets the settings.gradle that GradleProjectSpec generates use it too. That was the last remaining Sonatype reference in the test tree.

What the green run shows

Gradle's own resolution in the sub-builds now goes to CGP: 458 requests to artifacts.codegenomeproject.org, and the 11 remaining Sonatype snapshot requests all come from the main build's own org.openrewrite.tools:jgit and rewrite-polyglot dependencies, not from the fixtures.

Maven Central still sees 238 org/openrewrite/ requests, down from 443, and they are no longer Gradle resolving the fixture repositories:

• 84 come from the Gradle 4.10 suite, where CGP is last, so Central is asked first and misses.
• The rest are the recipe tasks themselves. Inside :rewriteRun / :rewriteDryRun, OpenRewrite's own pom downloader probes Central for the same snapshots and 404s; it does not go through Gradle's repository content filters. The tasks succeed regardless, and this is untouched by the fixture change.
• The latest.release / latest.integration crawl also has to list versions on every repository, Central included.

Verification

Locally with CGP credentials, RewriteRunTest.gradleDependencyManagement, which asserts the exact text of the generated build.gradle, passes; that confirms the rendered block matches at both indents and that the emitted repository DSL is valid. The rest of the suite hits Maven Central HTTP 429 from my machine for third-party artifacts (AGP, Lombok, Checkstyle, rewrite-testing-frameworks), so those were left to CI, which is green.

Both long CI runs on this branch stalled for 47 and 64 minutes storing a build cache entry, on community.develocity.cloud connection timeouts. That is unrelated to this change; the per-suite times are in line with the baseline.

Left out

The three fixtures that request recipe artifacts at latest.release / latest.integration still do. Pinning them would cut request volume sharply, as the issue notes, but it also freezes each one against a rewrite runtime that keeps moving, so it seemed worth a separate decision.

[MBoegers]

I don't like the magic number here. But its is only build tool logic that is invisible to normal users.

[timtebeek]

I'll go a step further and say I don't like how Gradle does interpolation in text blocks, which is why we need this. :)