[AndyScherzinger]

Maven Central rate-limits the CI runners (HTTP 429), which breaks two jobs on master and every PR based on it:

• Unit tests: AppTasksBeforeAndroid10Test fails with initializationError (MavenArtifactFetcher, IOException), because Robolectric can't download its Android 9 (SDK 28) jar. The Robolectric cache is keyed by the Robolectric version only. It was saved on 15 Oct, before the first SDK 28 test came in on 2 Nov, and a cache whose key exists is never saved again, so every run downloads that jar.
• Analysis: generateGplayDebugUnitTestLintModel fails to download Robolectric's nativeruntime-dist-compat jar ("Received status code 429 from server: Too Many Requests"). That workflow is synced from android-config and has no Gradle cache, so the fix has to be on the Gradle side.

Changes:

• build.gradle: Gradle tries Google's mirror of Maven Central (maven-central.storage-download.googleapis.com) before Maven Central. The dependency verification in gradle/verification-metadata.xml checks every artifact's checksum and PGP signature, whichever repository serves it. Maven Central stays as the fallback for artifacts the mirror doesn't have yet.
• app/build.gradle.kts: Robolectric downloads its Android SDK jars from the same mirror (robolectric.dependency.repo.url) and validates their SHA-512.
• scripts/analysis/lint-results.txt: the lint baseline goes from 14 to 17 warnings. Android Gradle Plugin 9.5.0 (c8a8297) added the MissingExplicitUriGrant check, which flags three intents already on master that pass a file URI without FLAG_GRANT_READ_URI_PERMISSION/FLAG_GRANT_WRITE_URI_PERMISSION: photo and video capture in ChatActivity and the one in PickImage. The analysis job compares against this file, so every PR fails with "warning count increased" until it changes. Fixing the three intents is tracked in Camera capture intents lack explicit URI grant flags (lint MissingExplicitUriGrant, AGP 9.5.0) #7017.
• unit-tests.yml: the cache key names the SDK levels the tests run on (robolectric-sdks-Linux-4.17-28-33), so a test on a new level gets a new cache. A cache is only saved once it holds a jar for every level, so a failed download can't save an incomplete one under the new key.

Verified: with this commit, #6977 passed both unit tests and analysis (commit 8b97998d8), which had failed before. Locally, the unit test classpath resolves through the mirror with --refresh-dependencies and verification passing, and Robolectric re-downloads the SDK 28 jar from the mirror byte-identical to the one from Maven Central.

🖼️ Screenshots

🏚️ Before	🏡 After
AppTasksBeforeAndroid10Test > initializationError FAILED	Unit tests and analysis pass

🚧 TODO

• Rebase the open PRs onto master once this is merged (e.g. chore(deps): update ubuntu:resolute docker digest to 6a06111 #7014)

🏁 Checklist

• ⛑️ Tests (unit and/or integration) are included or not needed
• 🔖 Capability is checked or not needed
• 🔙 Backport requests are created or not needed: /backport to stable-xx.x
• 📅 Milestone is set
• 🌸 PR title is meaningful (if it should be in the changelog: is it meaningful to users?)

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI

[github-actions]

Codacy

Lint

Type	master	PR
Warnings	14	17
Errors	0	0

SpotBugs

Category	Base	New
Bad practice	7	7
Correctness	8	8
Dodgy code	40	40
Internationalization	3	3
Malicious code vulnerability	3	3
Performance	7	7
Security	11	11
Total	79	79

Lint increased!

[github-actions]

📱 QA build

Download	app-qa-debug.apk
QR code	Open the QR code for this download
Commit	67ee783
Version	7015
Available until	7 days after this build

The QA build installs alongside a released Nextcloud app, so you can keep
using your existing install while testing.

Downloading the file requires a GitHub account, so open this link on the
device you want to test on, or transfer the APK to it.