diff --git a/README.md b/README.md index abcb2188..711b417b 100644 --- a/README.md +++ b/README.md @@ -70,12 +70,11 @@ These badges show the status of workflows in dummy repositories that use (or sho ## Resolving through the JFrog Edge The actions resolve, deploy and promote on SaaS Repox (`https://repox.jfrog.io`) by default. To resolve dependencies through -the JFrog Edge instead, set `repox-url: https://repox-internal.dev.sonar.build` on the `config-*` and `build-*` actions. +the production JFrog Edge instead, set `repox-url: https://repox-internal.sonar.build` on the `config-*` and `build-*` actions. - Deployment, publication, build info and promotion always use `https://repox.jfrog.io`: the Edge is read-only. -- With the Edge, the resolve token is issued by the Edge through `development/artifactory-edge-dev` on - `https://vault.dev.sonar.build`. Otherwise it comes from `development/artifactory` on `https://vault.sonar.build`. -- `repox-internal.dev.sonar.build` is only reachable from runners inside the SonarSource network. +- The internal Edge hostname is only reachable from runners inside the SonarSource network. +- To return resolution to SaaS, set `repox-url: https://repox.jfrog.io`. --- diff --git a/build-gradle/action.yml b/build-gradle/action.yml index 0ebd6745..6c5ec19b 100644 --- a/build-gradle/action.yml +++ b/build-gradle/action.yml @@ -45,7 +45,7 @@ inputs: for public repositories. default: '' repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io use-develocity: description: Whether to use Develocity for build tracking. diff --git a/build-maven/action.yml b/build-maven/action.yml index 3734dbad..824645bb 100644 --- a/build-maven/action.yml +++ b/build-maven/action.yml @@ -55,7 +55,7 @@ inputs: description: Maven flags for all subsequent mvn calls default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io use-develocity: description: Whether to use Develocity for build tracking. diff --git a/build-npm/action.yml b/build-npm/action.yml index 9b660b77..8477d3bf 100644 --- a/build-npm/action.yml +++ b/build-npm/action.yml @@ -33,7 +33,7 @@ inputs: description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies. default: 'true' repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io sonar-platform: description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. diff --git a/build-poetry/action.yml b/build-poetry/action.yml index 28a0c189..0bf9af8e 100644 --- a/build-poetry/action.yml +++ b/build-poetry/action.yml @@ -31,7 +31,7 @@ inputs: description: Path to the Poetry cache directory, relative to GitHub workspace. default: .cache/pypoetry repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io sonar-platform: description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. diff --git a/build-yarn/action.yml b/build-yarn/action.yml index 5a9aaeca..6b10f3ed 100644 --- a/build-yarn/action.yml +++ b/build-yarn/action.yml @@ -36,7 +36,7 @@ inputs: description: Deprecated. Use `disable-caching` instead. Whether to cache Yarn dependencies. default: 'true' repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io sonar-platform: description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans. @@ -133,10 +133,10 @@ runs: id: artifactory with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1 if: inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' diff --git a/config-gradle/action.yml b/config-gradle/action.yml index 830d4d5d..6c73baa1 100644 --- a/config-gradle/action.yml +++ b/config-gradle/action.yml @@ -10,7 +10,7 @@ inputs: and `public-reader` for public repositories. default: '' repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io use-develocity: description: Whether to use Develocity for build tracking. @@ -95,10 +95,10 @@ runs: id: artifactory with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1 if: steps.config-gradle-completed.outputs.skip != 'true' && inputs.use-develocity == 'true' diff --git a/config-maven/action.yml b/config-maven/action.yml index 72e146eb..90c7452f 100644 --- a/config-maven/action.yml +++ b/config-maven/action.yml @@ -13,7 +13,7 @@ inputs: description: Maven flags for all subsequent mvn calls default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io use-develocity: description: Whether to use Develocity for build tracking. @@ -96,10 +96,10 @@ runs: id: artifactory with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1 if: steps.config-maven-completed.outputs.skip != 'true' && inputs.use-develocity == 'true' diff --git a/config-npm/action.yml b/config-npm/action.yml index 4e8c6bbb..54f70b87 100644 --- a/config-npm/action.yml +++ b/config-npm/action.yml @@ -16,7 +16,7 @@ inputs: description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies. default: 'true' repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io host-actions-root: description: Path to the actions folder on the host (used when called from another local action) @@ -94,10 +94,10 @@ runs: id: secrets with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - name: Configure NPM authentication diff --git a/config-nuget/action.yml b/config-nuget/action.yml index c6a215f8..4d11d004 100644 --- a/config-nuget/action.yml +++ b/config-nuget/action.yml @@ -13,7 +13,7 @@ inputs: for public repositories. default: '' repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io runs: @@ -30,10 +30,10 @@ runs: id: secrets with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - name: Configure NuGet diff --git a/config-pip/action.yml b/config-pip/action.yml index b39a903d..188225f5 100644 --- a/config-pip/action.yml +++ b/config-pip/action.yml @@ -11,7 +11,7 @@ inputs: for public repositories. default: '' repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io cache-paths: description: Cache paths to use (multiline). @@ -76,10 +76,10 @@ runs: id: secrets with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - name: Set environment variables for Artifactory authentication diff --git a/config-poetry/action.yml b/config-poetry/action.yml index a9c4e668..d0593c63 100644 --- a/config-poetry/action.yml +++ b/config-poetry/action.yml @@ -13,7 +13,7 @@ inputs: description: PyPI virtual repository to resolve dependencies from default: sonarsource-pypi repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io poetry-virtualenvs-path: description: Path to the Poetry virtual environments, relative to GitHub workspace. The folder is cached only if it is a subdirectory of @@ -119,10 +119,10 @@ runs: id: secrets with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - name: Configure Poetry authentication diff --git a/config-uv/action.yml b/config-uv/action.yml index 43d35594..5f4ea32f 100644 --- a/config-uv/action.yml +++ b/config-uv/action.yml @@ -13,7 +13,7 @@ inputs: description: Name of the uv index in pyproject.toml to authenticate (e.g. repox for `[[tool.uv.index]]` with `name = "repox"`) default: repox repox-url: - description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge. + description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge. default: https://repox.jfrog.io uv-cache-dir: description: Path to the uv cache directory, relative to GitHub workspace @@ -107,10 +107,10 @@ runs: id: secrets with: # yamllint disable rule:line-length - url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }} + url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} secrets: | - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; - development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; + development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; # yamllint enable rule:line-length - name: Configure uv authentication