[hedinasr]

Part of BUILD-12160

Summary

New config-nuget action, so .NET repositories can resolve NuGet packages through the JFrog Edge with the same repox-url opt-in as the other config-* actions.

• Reads the reader token like the other config-* actions: development/artifactory/token/... on vault.sonar.build by default, development/artifactory-edge-dev/token/... on vault.dev.sonar.build with an Edge repox-url.
• Exports ARTIFACTORY_URL, ARTIFACTORY_USERNAME and ARTIFACTORY_ACCESS_TOKEN, plus ARTIFACTORY_USER and ARTIFACTORY_PASSWORD, which the NuGet configurations reference in packageSourceCredentials.
• With a repox-url other than SaaS, rewrites every package source value starting with https://repox.jfrog.io/artifactory/ in nuget-config-files to repox-url. The committed files keep SaaS Repox for local builds, and trustedSigners service indexes are unchanged. It fails when a listed file is missing or has no Repox package source.
• Bash only and no get-build-number, so it runs on Windows runners (Git Bash) and only needs id-token: write.
• README: new config-nuget section.

Test plan

• shellspec spec/config-nuget_spec.sh: 10 examples, 0 failures. pre-commit passes.
• sonar-dotnet-enterprise#2653 pinned to a09a8a6 (same tree as the squashed 518cd4e) with repox-url: https://repox-internal.dev.sonar.build: on Windows warp runners the action rewrites analyzers/NuGet.Config, private/analyzers/NuGet.Config and private/its/projects/NuGet.config, and dotnet restore succeeds from the Edge (.NET UTs NetFx, .NET UTs Net). .NET ITs fails on a S9415 ruling difference after a successful restore, the same as on master (run).

[hashicorp-vault-sonar-prod]

BUILD-12160

[julien-carsique-sonarsource]

Test plan: the live check is still unchecked. Please tick it once sonar-dotnet-enterprise#2653 restores from the Edge on a Windows runner, with a link to the run, before this is merged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
95.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · Adds Vault-backed NuGet credentials and rewrites package sources for configured builds

New config-nuget action enables .NET repositories to resolve NuGet packages through the JFrog Edge with the same repox-url opt-in as other config-* actions. Resolved issues with xargs trimming of config paths and coverage/analysis configuration.

✅ 2 closed

✅ Edge Case: xargs trimming mangles backslashes and quotes in config paths

📄 config-nuget/nuget_config.sh:54-58
config="$(echo "$config" | xargs)" trims whitespace but also runs xargs' quote and escape handling. On Windows runners, which this action explicitly supports, a listed path like its\NuGet.config turns into itsNuGet.config and the action fails with NuGet configuration file not found: itsNuGet.config. A path containing an apostrophe makes xargs exit with unmatched single quote, and set -e then aborts the script without the ::error:: annotation. I reproduced both locally. Trimming with parameter expansion avoids this.

✅ Quality: config-nuget added to kcov coverage but not to sonar.sources

📄 .shellspec:2
The PR adds config-nuget to the kcov --include-pattern in .shellspec, so coverage data is collected for nuget_config.sh. sonar-project.properties still lists sonar.sources without config-nuget, so SonarQube never analyzes the new script, and the coverage report for it goes unused. The coverage wiring is therefore only half done. Add config-nuget to sonar.sources.

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}