Is there a way to figure out what all public repository for dep resolution are added in the project, apart from looking at where a particular dependency is getting pulled from.

Ah easy way to prevent that is, to declare the repositories centrally in the settings script and switch the mode to fail on project repos. If then some project tries to add one or a bad practice plugin tries to add one, build will fail. Unless of course it is a settings plugin that adds the repository, but I think this is quite unlikely. But other than that, you can just iterate over the repositories to check what is added right now.

Yea, we have

dependencyResolutionManagement {
  @Suppress("UnstableApiUsage")
  repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
  ......
}

which prevents and should theoretically. We point or pull deps from our own artifactory, where the deps are mirrored. Started to notice 429, streaming from public maven for few coordinates.

With that setting neither projects nor project plugins can add any repositories without failing the build (unless that is broken which I don't believe). Do you also point the plugin repositories to your artifactory? Which coordinates are affected, is something outstanding for them? Without further investigation, the only thing that comes to mind would be a settings plugin that adds the repository. But just iterate over the repositories or set a breakpoint and check in the debugger.

Yes for plugins as well.

pluginManagement {
  repositories {
    maven(url = "https://...")
  }
}

Yep, looking at iterating it and see if something stands out. > Which coordinates are affected Noticed few pointing at - https://repo.maven.apache.org/maven2/com/github/ajalt/mordant/mordant/3.0.2/mordant-3.0.2.pom which should be fetched from our own proxy.

What is

rulesMode

?

Sorry..

dependencyResolutionManagement {
  @Suppress("UnstableApiUsage")
  repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)

  rulesMode.set(RulesMode.FAIL_ON_PROJECT_RULES)
}

Ah, forgot about that, but no, I don't thinks so. That setting is about component metadata rules which you can like repositories either declare in the settings script or in the project build scripts but not both. And just like the repositories you can then forbid either or configure which should be preferred. But that should not have anything to do with the repositories.

Ahh thanks.