[circleci-app]

Problem

Job 153 (publish) failed at sbt +publish with:

S3URLHandler - Using AWS Access Key Id: *** for bucket: private.mvn.codacy.com
AmazonS3Exception: Forbidden (Status Code: 403)
  at AmazonS3Client.getObjectMetadata(...)
  at S3URLHandler.getURLInfo(S3URLHandler.scala:271)
  at URLResource.exists(URLResource.java:81)
  at URLRepository.put(URLRepository.java:74)

fm-sbt-s3-resolver calls getObjectMetadata (an S3 HEAD request) to check whether an artifact already exists before uploading. The IAM permissions attached to the CodacyAWS context allow s3:PutObject on private.mvn.codacy.com but not s3:GetObject/s3:HeadObject, so the pre-flight existence check returns 403 and aborts the publish before any actual upload is attempted.

This regressed in #33, which was the first time this project published to the private S3 Maven repo (previously it published to Sonatype Central).

Fix

Add publishConfiguration := publishConfiguration.value.withOverwrite(true) to build.sbt. This sets the overwrite flag that Ivy passes into URLRepository.put. When overwrite = true, the if (!overwrite) block at line 74 is skipped entirely — no getObjectMetadata call, no 403. The actual PutObject upload then proceeds with the credentials that are authorised to write.

publishLocalConfiguration is updated in parallel for consistency with local publishLocal invocations.

Test plan

• Verify publish job in CI passes after this change
• Confirm artifact appears in s3://private.mvn.codacy.com at the expected path

https://app.circleci.com/agents/gh/codacy/chat/636cbca8-87a1-4f0a-b502-a2230d6a2943

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The proposed global overwrite behavior can replace existing S3 artifacts, creating non-reproducible releases and publish races. Scope overwrite to an explicit CI/job-153 opt-in while keeping normal publishes protected.

All required publish verification scenarios are missing, and the publish configuration has no automated coverage. Codacy reports the PR as up to standards.

About this PR

• Add automated or CI-level verification for the publish configuration and confirm the uploaded artifact is present at the expected S3 path.

Test suggestions

• Verify remote publish uses overwrite=true and does not perform the S3 metadata/existence check before uploading.
• Verify publishLocal uses overwrite=true.
• Run the publish job and confirm the artifact is uploaded to the expected S3 path.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify remote publish uses overwrite=true and does not perform the S3 metadata/existence check before uploading.
2. Verify publishLocal uses overwrite=true.
3. Run the publish job and confirm the artifact is uploaded to the expected S3 path.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Scope overwrite to the specific CI job or an explicit opt-in property, while retaining the default protection against replacing existing remote artifacts.