BUILD-11961 Support repox-internal edge for all build/config actions

[hedinasr]

BUILD-11961 Support repox-internal edge for all build/config actions

Summary

Ready the shared GitHub Actions for Edge Node + SaaS Artifactory (repox-internal.dev.sonar.build resolve, SaaS deploy):

• Vault: always use vault-action-wrapper default (vault.sonar.build); remove repox-url-based vault.dev switching from all Artifactory secret steps.
• Resolve vs deploy: repox-url for dependency resolution; new repox-deploy-url (default https://repox.jfrog.io) for publish on build-maven, build-npm, build-gradle, build-poetry, build-yarn.
• Federation wait: shared wait_artifactory_token_sync.sh polls a protected Artifactory API until HTTP 200 (skip for SaaS jfrog.io) in config-maven/npm/uv/gradle/poetry/pip and build-yarn.
• Gradle: ARTIFACTORY_RESOLVE_URL + init script prefer resolve URL while deploy overrides ARTIFACTORY_URL.

Actions touched

config-maven, config-npm, config-uv, config-gradle, config-poetry, config-pip, build-maven, build-npm, build-gradle, build-poetry, build-yarn, promote

Test plan

• Maven (sonar-dummy): edge resolve + SaaS deploy/promote
• Gradle / npm / uv (e.g. sonarcloud-core): edge resolve with branch dogfood
• Confirm SaaS-only workflows (default repox-url) skip the wait and behave unchanged
• Confirm no action still references vault.dev.sonar.build for Artifactory secrets

Related validation PRs:

• https://github.com/SonarSource/sonar-dummy/pull/637
• https://github.com/SonarSource/sonarcloud-core/pull/10815

[hashicorp-vault-sonar-prod]

BUILD-11961

[gitar-bot]

Code Review ✅ Approved 6 resolved / 6 findings

Updates shared build and config actions to support the repox-internal edge node and SaaS deployment, addressing issues with curl timeouts, retry behavior, and hardcoded ping URLs. No issues found.

✅ 6 resolved

✅ Security: Artifactory token passed on curl command line

📄 config-maven/action.yml:164-166
The Artifactory access token is passed via curl -u "user:token", which exposes the credential in the process argument list (readable via /proc//cmdline by other processes on the runner). Prefer feeding credentials to curl out-of-band, e.g. curl --netrc-file <(printf 'machine %s login %s password %s' "$host" "$ARTIFACTORY_USERNAME" "$ARTIFACTORY_ACCESS_TOKEN") or via -K config from stdin, so the token never appears in the command line.

✅ Quality: Any non-200 response retries for the full 5 minutes

📄 config-maven/action.yml:163-175
The loop only treats HTTP 200 as success and retries every other code for the full 60×5s window before failing. A genuine misconfiguration (e.g. 401 on bad credentials, 404 on wrong URL/repo path) is indistinguishable from the expected federation-lag 403, so a hard failure is delayed by up to 5 minutes with no early feedback. Consider failing fast on non-403/non-2xx codes and only retrying the expected federation-lag codes (403).

✅ Quality: Hardcoded dev ping curl runs for all builds incl. SaaS

📄 config-maven/action.yml:149-154
The added curl to the hardcoded https://repox-internal.dev.sonar.build/artifactory/api/system/ping runs unconditionally before the *jfrog.io* SaaS skip check, so even SaaS/production Repox builds make a request to a fixed dev host that has nothing to do with the actual REPOX_URL. This looks like a leftover debugging probe (verbose -v, output discarded to /dev/null, no effect on control flow). Move it below the SaaS exit and/or remove it, and use $REPOX_URL rather than a hardcoded dev host if the ping is intended to be meaningful.

✅ Performance: Unconditional 60s sleep added to every non-SaaS Maven build

📄 config-maven/action.yml:155-156
Every non-jfrog.io Repox build now blocks for a fixed 60s regardless of whether the token has already federated, adding a full minute to each CI run. This is acknowledged as temporary, but consider polling the ping endpoint until it succeeds (with a timeout cap) instead of a blind fixed sleep to avoid the fixed latency on all edge-node builds.

✅ Quality: curl retry lacks connect/max timeout

📄 shared/wait_artifactory_token_sync.sh:36-38
The polling curl has no --connect-timeout/--max-time, so a hung TCP connection to the edge node would stall an iteration indefinitely rather than counting as a failed attempt, defeating the 5-minute bound. Add --connect-timeout 5 --max-time 15 to keep each attempt time-boxed.

...and 1 more resolved from earlier reviews

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
97.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud