fix probing maven central for artifacts with 1000.0.0 version

Author: coado

packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/utils/DependencyUtils.kt

@@ -31,6 +31,7 @@ import org.gradle.api.artifacts.repositories.MavenArtifactRepository
 internal object DependencyUtils {
   private const val REACT_NATIVE_MAVEN_MIRROR_URL = "https://repo.reactnative.dev/maven2"
   private const val REACT_NATIVE_MAVEN_MIRROR_ENABLED_ENV = "RCT_REACT_NATIVE_MAVEN_MIRROR_ENABLED"
+  private const val UNPUBLISHED_MAVEN_VERSION = "1000.0.0"
 
   internal data class Coordinates(
       val versionString: String,
@@ -135,6 +136,11 @@ internal object DependencyUtils {
       coordinates: Coordinates,
   ) {
     if (coordinates.versionString.isBlank() || coordinates.hermesVersionString.isBlank()) return
+
+    val shouldConfigureReact = coordinates.versionString.isMavenArtifactVersionPublished()
+    val shouldConfigureHermes = coordinates.hermesVersionString.isMavenArtifactVersionPublished()
+    if (!shouldConfigureReact && !shouldConfigureHermes) return
+
     project.rootProject.allprojects { eachProject ->
       eachProject.configurations.all { configuration ->
         // Here we set a dependencySubstitution for both react-native and hermes-engine as those
@@ -146,10 +152,15 @@ internal object DependencyUtils {
             it.substitute(it.module(module)).using(it.module(dest)).because(reason)
           }
         }
-        configuration.resolutionStrategy.force(
-            "${coordinates.reactGroupString}:react-android:${coordinates.versionString}",
-        )
-        if (!(eachProject.findProperty(INTERNAL_USE_HERMES_NIGHTLY) as? String).toBoolean()) {
+        if (shouldConfigureReact) {
+          configuration.resolutionStrategy.force(
+              "${coordinates.reactGroupString}:react-android:${coordinates.versionString}",
+          )
+        }
+        if (
+            shouldConfigureHermes &&
+                !(eachProject.findProperty(INTERNAL_USE_HERMES_NIGHTLY) as? String).toBoolean()
+        ) {
           // Contributors only: The hermes-engine version is forced only if the user has
           // not opted into using nightlies for local development.
           configuration.resolutionStrategy.force(
@@ -212,7 +223,10 @@ internal object DependencyUtils {
           ),
       )
     }
-    return dependencySubstitution
+    // 1000.0.0 identifies a source checkout on main and is never published to Maven.
+    return dependencySubstitution.filterNot { (_, destination, _) ->
+      !destination.substringAfterLast(':').isMavenArtifactVersionPublished()
+    }
   }
 
   fun readVersionAndGroupStrings(
@@ -303,6 +317,9 @@ internal object DependencyUtils {
 
   internal fun String.isNightly(): Boolean = this.startsWith("0.0.0") || "-nightly-" in this
 
+  internal fun String.isMavenArtifactVersionPublished(): Boolean =
+      isNotBlank() && this != UNPUBLISHED_MAVEN_VERSION
+
   internal fun Project.exclusiveEnterpriseRepository() =
       when {
         hasProperty(SCOPED_EXCLUSIVE_ENTEPRISE_REPOSITORY) ->

packages/gradle-plugin/react-native-gradle-plugin/src/test/kotlin/com/facebook/react/utils/DependencyUtilsTest.kt

@@ -12,6 +12,7 @@ import com.facebook.react.utils.DependencyUtils.configureDependencies
 import com.facebook.react.utils.DependencyUtils.configureRepositories
 import com.facebook.react.utils.DependencyUtils.exclusiveEnterpriseRepository
 import com.facebook.react.utils.DependencyUtils.getDependencySubstitutions
+import com.facebook.react.utils.DependencyUtils.isMavenArtifactVersionPublished
 import com.facebook.react.utils.DependencyUtils.isNightly
 import com.facebook.react.utils.DependencyUtils.isReactNativeMavenMirrorEnabled
 import com.facebook.react.utils.DependencyUtils.mavenRepoFromURI
@@ -414,6 +415,22 @@ class DependencyUtilsTest {
     assertThat(project.configurations.first().resolutionStrategy.forcedModules.isEmpty()).isTrue()
   }
 
+  @Test
+  fun configureDependencies_withUnpublishedVersion_doesNotRequestReactNativeArtifacts() {
+    val project = createProject()
+
+    configureDependencies(project, DependencyUtils.Coordinates("1000.0.0", "4.5.6"))
+
+    val forcedModules = project.configurations.first().resolutionStrategy.forcedModules
+    assertThat(forcedModules.none { it.toString().contains(":1000.0.0") }).isTrue()
+    assertThat(forcedModules.any { it.toString() == "com.facebook.hermes:hermes-android:4.5.6" })
+        .isTrue()
+
+    val dependencySubstitutions =
+        getDependencySubstitutions(DependencyUtils.Coordinates("1000.0.0", "4.5.6"))
+    assertThat(dependencySubstitutions.none { it.second.contains(":1000.0.0") }).isTrue()
+  }
+
   @Test
   fun configureDependencies_withVersionString_appliesResolutionStrategy() {
     val project = createProject()
@@ -577,6 +594,12 @@ class DependencyUtilsTest {
     assertThat(hermesVersionString).isEqualTo("1000.0.0")
   }
 
+  @Test
+  fun isMavenArtifactVersionPublished_withMainVersion_returnsFalse() {
+    assertThat("1000.0.0".isMavenArtifactVersionPublished()).isFalse()
+    assertThat("0.88.0".isMavenArtifactVersionPublished()).isTrue()
+  }
+
   @Test
   fun readVersionString_withNightlyVersionString_returnsSnapshotVersion() {
     val propertiesFile =

packages/react-native/scripts/cocoapods/__tests__/maven_mirror_flag-test.rb

@@ -5,6 +5,8 @@
 
 require "test/unit"
 require_relative "../utils.rb"
+require_relative "../rncore.rb"
+require_relative "../rndependencies.rb"
 require_relative "../../../sdks/hermes-engine/hermes-utils.rb"
 
 class MavenMirrorFlagTests < Test::Unit::TestCase
@@ -39,4 +41,20 @@ def test_mavenMirror_isDisabledWhenExplicitlySetToFalse
         assert_false(ReactNativePodsUtils.react_native_maven_mirror_enabled?)
         assert_false(react_native_maven_mirror_enabled?)
     end
+
+    def test_unpublishedVersion_skipsAllArtifactLookups
+        assert_false(ReactNativePodsUtils.maven_artifact_version_published?('1000.0.0'))
+        assert_false(ReactNativePodsUtils.artifact_exists?('https://repo.reactnative.dev/maven2/example/1000.0.0/example.tar.gz'))
+        assert_false(ReactNativeCoreUtils.release_artifact_exists('1000.0.0'))
+        assert_false(ReactNativeCoreUtils.nightly_artifact_exists('1000.0.0'))
+        assert_false(ReactNativeDependenciesUtils.release_artifact_exists('1000.0.0'))
+        assert_false(ReactNativeDependenciesUtils.nightly_artifact_exists('1000.0.0'))
+        assert_false(release_artifact_exists('1000.0.0'))
+        assert_false(hermes_artifact_exists('https://repo.reactnative.dev/maven2/example/1000.0.0/example.tar.gz'))
+    end
+
+    def test_releaseVersion_isPublished
+        assert_true(ReactNativePodsUtils.maven_artifact_version_published?('0.88.0'))
+        assert_true(ReactNativePodsUtils.maven_artifact_version_published?('1000.0.0-abcdef123'))
+    end
 end

packages/react-native/scripts/cocoapods/rncore.rb

@@ -350,6 +350,8 @@ def self.generate_plist_content(mappings)
     end
 
     def self.stable_tarball_url(version, build_type, dsyms = false)
+        return nil if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         candidates = stable_tarball_urls(version, build_type, dsyms)
         return candidates.find { |url| artifact_exists(url) } || candidates.first
     end
@@ -367,6 +369,8 @@ def self.stable_tarball_urls(version, build_type, dsyms = false)
     end
 
     def self.nightly_tarball_url(version, configuration, dsyms = false)
+        return "" if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         artefact_coordinate = "react-native-artifacts"
         artefact_name = "reactnative-core-#{dsyms ? "dSYM-" : ""}#{configuration ? configuration : "debug"}.tar.gz"
         xml_url = "https://central.sonatype.com/repository/maven-snapshots/com/facebook/react/#{artefact_coordinate}/#{version}-SNAPSHOT/maven-metadata.xml"
@@ -465,10 +469,14 @@ def self.download_rncore_tarball(react_native_path, tarball_url, version, config
     end
 
     def self.release_artifact_exists(version)
+        return false if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         return stable_tarball_urls(version, :debug).any? { |url| artifact_exists(url) }
     end
 
     def self.nightly_artifact_exists(version)
+        return false if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         return artifact_exists(nightly_tarball_url(version, :debug).gsub("\\", ""))
     end
 

packages/react-native/scripts/cocoapods/rndependencies.rb

@@ -232,6 +232,8 @@ def self.podspec_source_download_prebuild_release_tarball()
     end
 
     def self.release_tarball_url(version, build_type)
+        return nil if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         candidates = release_tarball_urls(version, build_type)
         return candidates.find { |url| artifact_exists(url) } || candidates.first
     end
@@ -250,6 +252,8 @@ def self.release_tarball_urls(version, build_type)
     end
 
     def self.nightly_tarball_url(version, build_type)
+        return "" if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         artifact_coordinate = "react-native-artifacts"
         artifact_name = "reactnative-dependencies-#{build_type.to_s}.tar.gz"
         xml_url = "https://central.sonatype.com/repository/maven-snapshots/com/facebook/react/#{artifact_coordinate}/#{version}-SNAPSHOT/maven-metadata.xml"
@@ -373,10 +377,14 @@ def self.download_rndeps_tarball(react_native_path, tarball_url, version, config
     end
 
     def self.release_artifact_exists(version)
+        return false if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         return release_tarball_urls(version, :debug).any? { |url| artifact_exists(url) }
     end
 
     def self.nightly_artifact_exists(version)
+        return false if !ReactNativePodsUtils.maven_artifact_version_published?(version)
+
         return artifact_exists(nightly_tarball_url(version, :debug).gsub("\\", ""))
     end
 

packages/react-native/scripts/cocoapods/utils.rb

@@ -15,6 +15,7 @@
 class ReactNativePodsUtils
     MAVEN_CENTRAL_REPOSITORY = "https://repo1.maven.org/maven2"
     REACT_NATIVE_MAVEN_MIRROR_REPOSITORY = "https://repo.reactnative.dev/maven2"
+    UNPUBLISHED_MAVEN_VERSION = "1000.0.0"
 
     # Opt-in removal of the legacy TurboModule and component interop layers. Both are
     # off by default and will become the default in a future React Native release.
@@ -49,6 +50,11 @@ def self.react_native_maven_mirror_enabled?()
         value.downcase != "false" && value != "0"
     end
 
+    def self.maven_artifact_version_published?(version)
+        # 1000.0.0 identifies a source checkout on main and is never published to Maven.
+        return version != UNPUBLISHED_MAVEN_VERSION
+    end
+
     def self.warn_if_not_on_arm64
         if SysctlChecker.new().call_sysctl_arm64() == 1 && !Environment.new().ruby_platform().include?('arm64')
             Pod::UI.warn 'Do not use "pod install" from inside Rosetta2 (x86_64 emulation on arm64).'
@@ -833,6 +839,8 @@ def self.resolve_use_frameworks(spec, header_mappings_dir: nil, module_name: nil
     # (DNS failure, no route, ...) the probe is left uncached so that a
     # transient hiccup doesn't permanently mark the artifact as missing.
     def self.artifact_exists?(tarball_url)
+        return false if tarball_url.include?("/#{UNPUBLISHED_MAVEN_VERSION}/")
+
         unless @@artifact_exists_cache.key?(tarball_url)
             # -L is used to follow redirects, useful for the nightlies
             # The url is wrapped in quotes to avoid escaping & and ?.

packages/react-native/scripts/ios-prebuild/__tests__/utils-test.js

@@ -0,0 +1,52 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * @format
+ * @noflow
+ */
+
+'use strict';
+
+const {
+  computeNightlyTarballURL,
+  isMavenArtifactVersionPublished,
+} = require('../utils');
+
+describe('isMavenArtifactVersionPublished', () => {
+  it('rejects the unpublished main version', () => {
+    expect(isMavenArtifactVersionPublished('1000.0.0')).toBe(false);
+  });
+
+  it.each([
+    '0.88.0',
+    '0.89.0-nightly-20260909-abcdef123',
+    '1000.0.0-abcdef123',
+  ])('accepts published artifact version %s', version => {
+    expect(isMavenArtifactVersionPublished(version)).toBe(true);
+  });
+});
+
+describe('computeNightlyTarballURL', () => {
+  it('does not query snapshot metadata for the unpublished main version', async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = jest.fn();
+
+    try {
+      await expect(
+        computeNightlyTarballURL(
+          '1000.0.0',
+          'Debug',
+          'react',
+          'react-native-artifacts',
+          'reactnative-dependencies-debug.tar.gz',
+        ),
+      ).rejects.toThrow(/artifacts are not published/);
+      expect(globalThis.fetch).not.toHaveBeenCalled();
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+});

packages/react-native/scripts/ios-prebuild/hermes.js

@@ -8,7 +8,11 @@
  * @format
  */
 
-const {createLogger, getMavenRepositoryUrls} = require('./utils');
+const {
+  createLogger,
+  getMavenRepositoryUrls,
+  isMavenArtifactVersionPublished,
+} = require('./utils');
 const {execSync} = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
@@ -62,7 +66,10 @@ async function prepareHermesArtifactsAsync(
     // Resolve the version from the environment variable or use the default version
     let resolvedVersion = process.env.HERMES_VERSION ?? 'latest-v1';
 
-    if (resolvedVersion === 'latest-v1') {
+    if (
+      resolvedVersion === 'latest-v1' ||
+      !isMavenArtifactVersionPublished(resolvedVersion)
+    ) {
       // TODO: rename 'latest-v1' to 'latest' once V1 is the only Hermes on npm
       hermesLog('Using latest-v1 tarball');
       const hermesVersion = await getLatestHermesVersionFromNPM();

packages/react-native/scripts/ios-prebuild/reactNativeDependencies.js

@@ -14,6 +14,7 @@ const {
   computeNightlyTarballURL,
   createLogger,
   getMavenRepositoryUrls,
+  isMavenArtifactVersionPublished,
 } = require('./utils');
 const {execSync} = require('node:child_process');
 const fs = require('node:fs');
@@ -49,7 +50,10 @@ async function prepareReactNativeDependenciesArtifactsAsync(
   // Resolve the version from the environment variable or use the default version
   let resolvedVersion = process.env.RN_DEP_VERSION ?? version;
 
-  if (resolvedVersion === 'nightly') {
+  if (
+    resolvedVersion === 'nightly' ||
+    !isMavenArtifactVersionPublished(resolvedVersion)
+  ) {
     dependencyLog('Using latest nightly tarball');
     const rnVersion = await getNightlyVersionFromNPM();
     resolvedVersion = rnVersion;

packages/react-native/scripts/ios-prebuild/utils.js

@@ -17,6 +17,7 @@ const path = require('node:path');
 const MAVEN_CENTRAL_REPOSITORY = 'https://repo1.maven.org/maven2';
 const REACT_NATIVE_MAVEN_MIRROR_REPOSITORY =
   'https://repo.reactnative.dev/maven2';
+const UNPUBLISHED_MAVEN_VERSION = '1000.0.0';
 
 /**
  * Creates a folder if it does not exist
@@ -96,6 +97,12 @@ async function computeNightlyTarballURL(
   artifactCoordinate /*: string */,
   artifactName /*: string */,
 ) /*: Promise<string> */ {
+  if (!isMavenArtifactVersionPublished(version)) {
+    throw new Error(
+      `Maven artifacts are not published for the development version ${version}`,
+    );
+  }
+
   const xmlUrl = `https://central.sonatype.com/repository/maven-snapshots/com/facebook/${subGroup}/${artifactCoordinate}/${version}-SNAPSHOT/maven-metadata.xml`;
 
   const response = await fetch(xmlUrl);
@@ -156,11 +163,17 @@ function isReactNativeMavenMirrorEnabled() /*: boolean */ {
   return value.toLowerCase() !== 'false' && value !== '0';
 }
 
+function isMavenArtifactVersionPublished(version /*: string */) /*: boolean */ {
+  // 1000.0.0 identifies a source checkout on main and is never published to Maven.
+  return version !== UNPUBLISHED_MAVEN_VERSION;
+}
+
 module.exports = {
   createFolderIfNotExists,
   findFirst,
   throwIfOnEden,
   createLogger,
   computeNightlyTarballURL,
   getMavenRepositoryUrls,
+  isMavenArtifactVersionPublished,
 };