BUILD-11961 Support repox-internal edge for all build/config actions

build-gradle/action.yml

@@ -45,7 +45,10 @@ inputs:
       for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox
+    description: URL for Repox used for dependency resolution
+    default: https://repox.jfrog.io
+  repox-deploy-url:
+    description: URL for Repox used for artifact deployment. Defaults to SaaS Repox so deploy does not depend on edge Access Federation.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
@@ -129,7 +132,6 @@ runs:
       if: inputs.deploy != 'false' && inputs.run-shadow-scans != 'true'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         # yamllint disable rule:line-length
         secrets: |
           ${{ format('development/artifactory/token/{{REPO_OWNER_NAME_DASH}}-{0} username | ARTIFACTORY_DEPLOY_USERNAME;', env.ARTIFACTORY_DEPLOYER_ROLE) }}
@@ -169,6 +171,8 @@ runs:
         RUN_SHADOW_SCANS: ${{ inputs.run-shadow-scans }}
         ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
           github.event.repository.visibility == 'public' && 'sonarsource-public-qa' || 'sonarsource-private-qa' }}
+        # Upload target for artifactoryPublish (downloads still use ARTIFACTORY_RESOLVE_URL from config-gradle).
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
 
         # Vault secrets
         # yamllint disable rule:line-length
@@ -217,6 +221,8 @@ runs:
     - name: Generate workflow summary
       if: always() && inputs.generate-summary != 'false'
       shell: bash
+      env:
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
       run: |
         build_name="${GITHUB_REPOSITORY#*/}"
         echo "## 🏗 Gradle Build Summary (\`${GITHUB_JOB}\`)" >> $GITHUB_STEP_SUMMARY

build-maven/action.yml

@@ -49,7 +49,10 @@ inputs:
     description: Maven flags for all subsequent mvn calls
     default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
   repox-url:
-    description: URL for Repox
+    description: URL for Repox used for dependency resolution (Maven mirror)
+    default: https://repox.jfrog.io
+  repox-deploy-url:
+    description: URL for Repox used for artifact deployment. Defaults to SaaS Repox so deploy does not depend on edge Access Federation.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
@@ -125,6 +128,8 @@ runs:
       env:
         MIXED_PRIVACY: ${{ inputs.mixed-privacy }}
         USER_MAVEN_ARGS: ${{ inputs.maven-args }}
+        ARTIFACTORY_RESOLVE_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_DEPLOY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
         ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
           (github.event.repository.visibility == 'public' || inputs.mixed-privacy == 'true') && 'sonarsource-public-qa' ||
           'sonarsource-private-qa' }}
@@ -141,17 +146,21 @@ runs:
           fi
           echo "USER_MAVEN_ARGS=${USER_MAVEN_ARGS}"
           echo "ARTIFACTORY_DEPLOY_REPO=${ARTIFACTORY_DEPLOY_REPO}"
+          echo "ARTIFACTORY_DEPLOY_URL=${ARTIFACTORY_DEPLOY_URL}"
           echo "ARTIFACTORY_DEPLOY_USERNAME_VAULT=development/artifactory/token/{REPO_OWNER_NAME_DASH}-${ARTIFACTORY_DEPLOYER_ROLE} username | ARTIFACTORY_DEPLOY_USERNAME;"
           echo "ARTIFACTORY_DEPLOY_ACCESS_TOKEN_VAULT=development/artifactory/token/{REPO_OWNER_NAME_DASH}-${ARTIFACTORY_DEPLOYER_ROLE} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;"
         } >> "$GITHUB_OUTPUT"
-        echo "SONARSOURCE_REPOSITORY_URL=${ARTIFACTORY_URL}/sonarsource" >> "$GITHUB_ENV"
+        # Downloads (Maven settings mirror) always use repox-url; uploads use ARTIFACTORY_DEPLOY_URL / repox-deploy-url.
+        echo "ARTIFACTORY_URL=${ARTIFACTORY_RESOLVE_URL}" >> "$GITHUB_ENV"
+        echo "SONARSOURCE_REPOSITORY_URL=${ARTIFACTORY_RESOLVE_URL}/sonarsource" >> "$GITHUB_ENV"
+        echo "Artifactory resolve (download): ${ARTIFACTORY_RESOLVE_URL}"
+        echo "Artifactory deploy (upload): ${ARTIFACTORY_DEPLOY_URL}"
       # yamllint enable rule:line-length
 
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       if: inputs.deploy != 'false'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         # yamllint disable rule:line-length
         secrets: |
           ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_USERNAME_VAULT || '' }}
@@ -190,6 +199,8 @@ runs:
         SONAR_PLATFORM: ${{ inputs.sonar-platform }}
         RUN_SHADOW_SCANS: ${{ inputs.run-shadow-scans }}
         ARTIFACTORY_DEPLOY_REPO: ${{ steps.params.outputs.ARTIFACTORY_DEPLOY_REPO }}
+        # Upload target for the Artifactory Maven plugin / parent POM (downloads still use SONARSOURCE_REPOSITORY_URL).
+        ARTIFACTORY_URL: ${{ steps.params.outputs.ARTIFACTORY_DEPLOY_URL }}
 
         # Vault secrets
         # yamllint disable rule:line-length
@@ -214,6 +225,7 @@ runs:
         inputs.mixed-privacy == 'true' && steps.build.outputs.deployed == 'true' &&
         (github.event_name != 'pull_request' || inputs.deploy-pull-request == 'true')
       env:
+        ARTIFACTORY_URL: ${{ steps.params.outputs.ARTIFACTORY_DEPLOY_URL }}
         ARTIFACTORY_DEPLOY_REPO: ${{ steps.params.outputs.ARTIFACTORY_DEPLOY_REPO }}
         # yamllint disable rule:line-length
         ARTIFACTORY_DEPLOY_ACCESS_TOKEN: ${{ steps.artifactory.outputs.vault && fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN || '' }}
@@ -246,6 +258,7 @@ runs:
       if: always() && inputs.generate-summary != 'false'
       shell: bash
       env:
+        ARTIFACTORY_URL: ${{ steps.params.outputs.ARTIFACTORY_DEPLOY_URL }}
         JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR: ${{ runner.temp }}/jfrog-summary
       run: |
         build_name="${GITHUB_REPOSITORY#*/}"

build-npm/action.yml

@@ -33,7 +33,10 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox
+    description: URL for Repox used for dependency resolution (npm registry)
+    default: https://repox.jfrog.io
+  repox-deploy-url:
+    description: URL for Repox used for artifact deployment. Defaults to SaaS Repox so deploy does not depend on edge Access Federation.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
@@ -135,7 +138,6 @@ runs:
       if: inputs.deploy != 'false' && inputs.run-shadow-scans != 'true'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         # yamllint disable rule:line-length
         secrets: |
           ${{ format('development/artifactory/token/{{REPO_OWNER_NAME_DASH}}-{0} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;', env.ARTIFACTORY_DEPLOYER_ROLE) }}
@@ -162,7 +164,8 @@ runs:
         DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         BUILD_NAME: ${{ inputs.build-name || github.event.repository.name }}
 
-        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        # Upload target for jf npm publish (downloads still use ~/.npmrc from config-npm / repox-url).
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
         ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
           (github.event.repository.visibility == 'public' && 'sonarsource-npm-public-qa' || 'sonarsource-npm-private-qa') }}
         # yamllint disable rule:line-length
@@ -215,7 +218,7 @@ runs:
       if: always() && inputs.generate-summary != 'false'
       shell: bash
       env:
-        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
         JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR: ${{ runner.temp }}/jfrog-summary
       run: |
         build_name="${GITHUB_REPOSITORY#*/}"

build-poetry/action.yml

@@ -31,7 +31,10 @@ inputs:
     description: Path to the Poetry cache directory, relative to GitHub workspace.
     default: .cache/pypoetry
   repox-url:
-    description: URL for Repox
+    description: URL for Repox used for dependency resolution
+    default: https://repox.jfrog.io
+  repox-deploy-url:
+    description: URL for Repox used for artifact deployment. Defaults to SaaS Repox so deploy does not depend on edge Access Federation.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
@@ -123,7 +126,6 @@ runs:
       if: inputs.deploy != 'false' && inputs.run-shadow-scans != 'true'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         # yamllint disable rule:line-length
         secrets: |
           ${{ format('development/artifactory/token/{{REPO_OWNER_NAME_DASH}}-{0} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;', env.ARTIFACTORY_DEPLOYER_ROLE) }}
@@ -149,8 +151,8 @@ runs:
         PULL_REQUEST_SHA: ${{ github.event.pull_request.base.sha || '' }}
         DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
 
-        # Action inputs
-        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        # Upload target for jf poetry publish (downloads still use config-poetry / repox-url).
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
         DEPLOY: ${{ inputs.deploy }}
         DEPLOY_PULL_REQUEST: ${{ inputs.deploy-pull-request }}
         ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
@@ -193,7 +195,7 @@ runs:
       if: always() && inputs.generate-summary != 'false'
       shell: bash
       env:
-        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
         JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR: ${{ runner.temp }}/jfrog-summary
       run: |
         build_name="${GITHUB_REPOSITORY#*/}"

build-yarn/action.yml

@@ -36,7 +36,10 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache Yarn dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox
+    description: URL for Repox used for dependency resolution (npm registry)
+    default: https://repox.jfrog.io
+  repox-deploy-url:
+    description: URL for Repox used for artifact deployment. Defaults to SaaS Repox so deploy does not depend on edge Access Federation.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
@@ -130,13 +133,23 @@ runs:
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         # yamllint disable rule:line-length
         secrets: |
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
           ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && format('development/artifactory/token/{{REPO_OWNER_NAME_DASH}}-{0} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;', env.ARTIFACTORY_DEPLOYER_ROLE) || '' }}
         # yamllint enable rule:line-length
+
+    # Temporary: Access Federation can lag when SaaS-minted tokens are used on an edge node.
+    - name: Wait for Artifactory token to sync
+      shell: bash
+      env:
+        REPOX_URL: ${{ inputs.repox-url }}
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_USERNAME: ${{ fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_USERNAME }}
+        ARTIFACTORY_ACCESS_TOKEN: ${{ fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
+      run: $ACTION_PATH_BUILD_YARN/../shared/wait_artifactory_token_sync.sh
+
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       id: secrets
       # yamllint disable rule:line-length
@@ -160,6 +173,7 @@ runs:
 
         # Action inputs
         ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_DEPLOY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
         ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
           github.event.repository.visibility == 'public' && 'sonarsource-public-qa' || 'sonarsource-private-qa' }}
         ARTIFACTORY_USERNAME: ${{ fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_USERNAME }}
@@ -198,7 +212,7 @@ runs:
       if: always() && inputs.generate-summary != 'false'
       shell: bash
       env:
-        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-deploy-url) }}
         JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR: ${{ runner.temp }}/jfrog-summary
       run: |
         build_name="${GITHUB_REPOSITORY#*/}"

build-yarn/build.sh

@@ -171,9 +171,10 @@ sonar_scanner_implementation() {
 }
 
 jfrog_yarn_publish() {
-  echo "::debug::Configuring JFrog and NPM repositories..."
+  local deploy_url="${ARTIFACTORY_DEPLOY_URL:-$ARTIFACTORY_URL}"
+  echo "::debug::Configuring JFrog and NPM repositories for deploy ($deploy_url)..."
   jf config remove repox > /dev/null 2>&1 || true # Ignore inexistent configuration
-  jf config add repox --url "${ARTIFACTORY_URL%/artifactory*}" --artifactory-url "$ARTIFACTORY_URL" --access-token "$ARTIFACTORY_DEPLOY_ACCESS_TOKEN"
+  jf config add repox --url "${deploy_url%/artifactory*}" --artifactory-url "$deploy_url" --access-token "$ARTIFACTORY_DEPLOY_ACCESS_TOKEN"
   jf config use repox
   jf npm-config --global --repo-resolve "npm" --repo-deploy "$ARTIFACTORY_DEPLOY_REPO"
 

config-gradle/action.yml

@@ -10,7 +10,7 @@ inputs:
       and `public-reader` for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox
+    description: URL for Repox used for dependency resolution
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
@@ -92,7 +92,6 @@ runs:
       if: steps.config-gradle-completed.outputs.skip != 'true'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
@@ -131,6 +130,8 @@ runs:
         fi
 
         echo "ARTIFACTORY_URL=$ARTIFACTORY_URL" >> "$GITHUB_ENV"
+        # Resolve URL kept separately so build steps can override ARTIFACTORY_URL for deploy.
+        echo "ARTIFACTORY_RESOLVE_URL=$ARTIFACTORY_URL" >> "$GITHUB_ENV"
         echo "ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME" >> "$GITHUB_ENV"
         echo "ARTIFACTORY_ACCESS_USERNAME=$ARTIFACTORY_USERNAME" >> "$GITHUB_ENV"  # deprecated, backward compliance
         echo "ARTIFACTORY_ACCESS_TOKEN=$ARTIFACTORY_ACCESS_TOKEN" >> "$GITHUB_ENV"
@@ -139,6 +140,14 @@ runs:
           echo "DEVELOCITY_ACCESS_KEY=${{ steps.develocity-hostname.outputs.hostname }}=$DEVELOCITY_TOKEN" >> "$GITHUB_ENV"
         fi
 
+    # Temporary: Access Federation can lag when SaaS-minted tokens are used on an edge node.
+    - name: Wait for Artifactory token to sync
+      if: steps.config-gradle-completed.outputs.skip != 'true'
+      shell: bash
+      env:
+        REPOX_URL: ${{ inputs.repox-url }}
+      run: $ACTION_PATH_CONFIG_GRADLE/../shared/wait_artifactory_token_sync.sh
+
     - name: Configure Gradle wrapper download resilience
       if: steps.config-gradle-completed.outputs.skip != 'true'
       shell: bash

config-gradle/resources/repoxAuth.init.gradle.kts

@@ -89,7 +89,11 @@ allprojects {
 
 class RepoxAuth {
     companion object {
-        val artifactoryUrl = System.getenv("ARTIFACTORY_URL") ?: "https://repox.jfrog.io/artifactory"
+        // Prefer ARTIFACTORY_RESOLVE_URL so dependency resolution can target an edge node
+        // while ARTIFACTORY_URL is used for artifactoryPublish / deploy (often SaaS).
+        val artifactoryUrl = System.getenv("ARTIFACTORY_RESOLVE_URL")
+            ?: System.getenv("ARTIFACTORY_URL")
+            ?: "https://repox.jfrog.io/artifactory"
         val host = java.net.URI(artifactoryUrl).host
         val sonarsourceRepositoryUrl =
             RepoxAuth.artifactoryUrl.trimEnd('/') + "/" + (System.getenv("SONARSOURCE_REPOSITORY") ?: "sonarsource")

config-maven/action.yml

@@ -93,7 +93,6 @@ runs:
       if: steps.config-maven-completed.outputs.skip != 'true'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
@@ -140,6 +139,14 @@ runs:
           echo "DEVELOCITY_ACCESS_KEY=${{ steps.develocity-hostname.outputs.hostname }}=$DEVELOCITY_TOKEN" >> "$GITHUB_ENV"
         fi
 
+    # Temporary: Access Federation can lag when SaaS-minted tokens are used on an edge node.
+    - name: Wait for Artifactory token to sync
+      if: steps.config-maven-completed.outputs.skip != 'true'
+      shell: bash
+      env:
+        REPOX_URL: ${{ inputs.repox-url }}
+      run: $ACTION_PATH_CONFIG_MAVEN/../shared/wait_artifactory_token_sync.sh
+
     - name: Configure Maven settings and set repository URL
       if: steps.config-maven-completed.outputs.skip != 'true'
       shell: bash