CI Runners Suddenly Failing with 403 Forbidden for Maven/Gradle Repositories (ubuntu-latest)

[kratikakumari-28]

Since today, our CI pipelines running on ubuntu-latest and other hosted runners have started failing while downloading dependencies from Maven/Gradle repositories, returning HTTP 403 Forbidden errors.

Observed Behavior : Maven/Gradle dependency resolution fails with 403 Forbidden
Happens consistently on: ubuntu-latest
Affected tools:
Maven
Gradle
Example error:
Could not transfer artifact ...
Received status code 403 from server

Its critical can someone help promptly.

[Vullnettt]

We have the exact same issue starting today: GitHub Actions hosted runners (including ubuntu-latest) are failing dependency downloads from Maven/Gradle repos with HTTP 403 Forbidden (e.g., https://repo.maven.apache.org/maven2/...).

No changes were made to build.gradle, settings.gradle, or the workflow—local builds still succeed.

[CDRussell]

We have the same issue. Perhaps caused by GitHub cache not working correctly which would force lots of extra traffic onto maven repos resulting in HTTP 429 [too many requests] and HTTP 403 [Forbidden] which is what we've been seeing.

In our build logs, we see this for the GitHub caching output:

Our services aren't available right now
We're working to restore all services as soon as possible. Please check back soon.

[gimquokka]

The issue appears to have been resolved. Please try again.

[StianHaSu]

The issue appears to have been resolved. Please try again.

No it has not.
But now ~2 hours later, it has

[tsal]

The issue appears to have been resolved. Please try again.

Nope, but this indicates that it's an IP-range or specific set of runners having this issue. All the more reason that GitHub should be the ones to chase down the problem, and also notify their users of said problem. Maven might be the only tooling affected, but it's not a minor thing.

[martinbonnin]

Most likely a case of Sonatype enforcing a stronger throttling to prevent bandwidth abuse, they've been talking about doing this for a while: https://www.sonatype.com/blog/maven-central-and-the-tragedy-of-the-commons

Nope, this wasn't intentional

[bric3]

https://github.com/orgs/community/discussions/183607#discussioncomment-15424807

[maxtheaxe]

Seeing this as well.

[TingluoHuang]

https://status.maven.org/

[AlexMFV]

+1 having the same problem as well, changing to the https://repo.maven.apache.org/maven2/ mirror seemed to make the CI run again

[maxtheaxe]

+1 having the same problem as well, changing to the https://repo.maven.apache.org/maven2/ mirror temporarily seemed to make the CI run again

Temporary as in it started failing afterwards as well, or is it working now?

[AlexMFV]

Sorry, yes changing to that mirror worked, and its still working

[kacperaniolek]

Should be working now

We believe this is now fixed. I'll watch this space for any additional issues.

What seems to have happened is that someone tried to make 7m requests all in a tight timeframe with an unusual user agent. The appropriately triggered the DDOS defense, but the way the CF rules seem to work it affected a large chunk of the GH infrastructure. We will be working with the CDN to better understand and tune this response to attempt to limit splash damage from hostile actors.

https://github.com/orgs/community/discussions/183607#discussioncomment-15425386

[pranshucars98]

Still Its failing from ours end