From 5e56c0baa8978f11c600f865ef6bdcc8f07ff150 Mon Sep 17 00:00:00 2001
From: Brian <brian.walsh@sonarsource.com>
Date: Tue, 6 Oct 2026 12:36:01 -0500
Subject: [PATCH 1/2] BUILD-12911: Resolve Edge reader tokens through
 production Vault

---
 README.md                | 14 ++++++++++----
 build-gradle/action.yml  |  3 ++-
 build-maven/action.yml   |  3 ++-
 build-npm/action.yml     |  3 ++-
 build-poetry/action.yml  |  3 ++-
 build-yarn/action.yml    |  9 +++++----
 config-gradle/action.yml |  9 +++++----
 config-maven/action.yml  |  9 +++++----
 config-npm/action.yml    |  9 +++++----
 config-nuget/action.yml  |  9 +++++----
 config-pip/action.yml    |  9 +++++----
 config-poetry/action.yml |  9 +++++----
 config-uv/action.yml     |  9 +++++----
 13 files changed, 58 insertions(+), 40 deletions(-)

diff --git a/README.md b/README.md
index abcb2188..e6ba1d3a 100644
--- a/README.md
+++ b/README.md
@@ -70,12 +70,18 @@ These badges show the status of workflows in dummy repositories that use (or sho
 ## Resolving through the JFrog Edge
 
 The actions resolve, deploy and promote on SaaS Repox (`https://repox.jfrog.io`) by default. To resolve dependencies through
-the JFrog Edge instead, set `repox-url: https://repox-internal.dev.sonar.build` on the `config-*` and `build-*` actions.
+the production JFrog Edge instead, set `repox-url: https://repox-internal.sonar.build` on the `config-*` and `build-*` actions.
+Use `https://repox-internal.dev.sonar.build` for the dev Edge.
 
 - Deployment, publication, build info and promotion always use `https://repox.jfrog.io`: the Edge is read-only.
-- With the Edge, the resolve token is issued by the Edge through `development/artifactory-edge-dev` on
-  `https://vault.dev.sonar.build`. Otherwise it comes from `development/artifactory` on `https://vault.sonar.build`.
-- `repox-internal.dev.sonar.build` is only reachable from runners inside the SonarSource network.
+- Resolve credentials always come from production Vault (`https://vault.sonar.build`). SaaS uses
+  `development/artifactory`; dev Edge uses `development/artifactory-edge-dev`; production Edge uses
+  `development/artifactory-edge-prod`. Edge reader tokens are issued directly by the corresponding Edge.
+- The internal Edge hostnames are only reachable from runners inside the SonarSource network. Their public aliases
+  `repox.dev.sonar.build` and `repox.sonar.build` select the same dev and production engines, respectively.
+- Before adopting these actions for either Edge, its production Vault engine must be seeded and configured.
+  Keep older action versions on dev Vault until migration completes. To return resolution to SaaS, set
+  `repox-url: https://repox.jfrog.io`.
 
 ---
 
diff --git a/build-gradle/action.yml b/build-gradle/action.yml
index 0ebd6745..e4fd7b50 100644
--- a/build-gradle/action.yml
+++ b/build-gradle/action.yml
@@ -45,7 +45,8 @@ inputs:
       for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
diff --git a/build-maven/action.yml b/build-maven/action.yml
index 3734dbad..bb302899 100644
--- a/build-maven/action.yml
+++ b/build-maven/action.yml
@@ -55,7 +55,8 @@ inputs:
     description: Maven flags for all subsequent mvn calls
     default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
diff --git a/build-npm/action.yml b/build-npm/action.yml
index 9b660b77..3f7d8d13 100644
--- a/build-npm/action.yml
+++ b/build-npm/action.yml
@@ -33,7 +33,8 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
diff --git a/build-poetry/action.yml b/build-poetry/action.yml
index 28a0c189..82715220 100644
--- a/build-poetry/action.yml
+++ b/build-poetry/action.yml
@@ -31,7 +31,8 @@ inputs:
     description: Path to the Poetry cache directory, relative to GitHub workspace.
     default: .cache/pypoetry
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
diff --git a/build-yarn/action.yml b/build-yarn/action.yml
index 5a9aaeca..07a1127e 100644
--- a/build-yarn/action.yml
+++ b/build-yarn/action.yml
@@ -36,7 +36,8 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache Yarn dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
@@ -133,10 +134,10 @@ runs:
       id: artifactory
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       if: inputs.deploy != 'false' && inputs.run-shadow-scans != 'true'
diff --git a/config-gradle/action.yml b/config-gradle/action.yml
index 830d4d5d..a4210f22 100644
--- a/config-gradle/action.yml
+++ b/config-gradle/action.yml
@@ -10,7 +10,8 @@ inputs:
       and `public-reader` for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
@@ -95,10 +96,10 @@ runs:
       id: artifactory
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       if: steps.config-gradle-completed.outputs.skip != 'true' && inputs.use-develocity == 'true'
diff --git a/config-maven/action.yml b/config-maven/action.yml
index 72e146eb..a60cbf71 100644
--- a/config-maven/action.yml
+++ b/config-maven/action.yml
@@ -13,7 +13,8 @@ inputs:
     description: Maven flags for all subsequent mvn calls
     default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
@@ -96,10 +97,10 @@ runs:
       id: artifactory
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       if: steps.config-maven-completed.outputs.skip != 'true' && inputs.use-develocity == 'true'
diff --git a/config-npm/action.yml b/config-npm/action.yml
index 4e8c6bbb..e659824c 100644
--- a/config-npm/action.yml
+++ b/config-npm/action.yml
@@ -16,7 +16,8 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   host-actions-root:
     description: Path to the actions folder on the host (used when called from another local action)
@@ -94,10 +95,10 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
 
     - name: Configure NPM authentication
diff --git a/config-nuget/action.yml b/config-nuget/action.yml
index c6a215f8..b60ae8cb 100644
--- a/config-nuget/action.yml
+++ b/config-nuget/action.yml
@@ -13,7 +13,8 @@ inputs:
       for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
 
 runs:
@@ -30,10 +31,10 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
 
     - name: Configure NuGet
diff --git a/config-pip/action.yml b/config-pip/action.yml
index b39a903d..6a1345ca 100644
--- a/config-pip/action.yml
+++ b/config-pip/action.yml
@@ -11,7 +11,8 @@ inputs:
       for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   cache-paths:
     description: Cache paths to use (multiline).
@@ -76,10 +77,10 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
 
     - name: Set environment variables for Artifactory authentication
diff --git a/config-poetry/action.yml b/config-poetry/action.yml
index a9c4e668..7cd2234e 100644
--- a/config-poetry/action.yml
+++ b/config-poetry/action.yml
@@ -13,7 +13,8 @@ inputs:
     description: PyPI virtual repository to resolve dependencies from
     default: sonarsource-pypi
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   poetry-virtualenvs-path:
     description: Path to the Poetry virtual environments, relative to GitHub workspace. The folder is cached only if it is a subdirectory of
@@ -119,10 +120,10 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
 
     - name: Configure Poetry authentication
diff --git a/config-uv/action.yml b/config-uv/action.yml
index 43d35594..c1c3dddb 100644
--- a/config-uv/action.yml
+++ b/config-uv/action.yml
@@ -13,7 +13,8 @@ inputs:
     description: Name of the uv index in pyproject.toml to authenticate (e.g. repox for `[[tool.uv.index]]` with `name = "repox"`)
     default: repox
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.dev.sonar.build for the JFrog Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
+      or https://repox-internal.dev.sonar.build for the dev Edge.
     default: https://repox.jfrog.io
   uv-cache-dir:
     description: Path to the uv cache directory, relative to GitHub workspace
@@ -107,10 +108,10 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: ${{ contains(inputs.repox-url, 'jfrog.io') && 'https://vault.sonar.build' || 'https://vault.dev.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
-          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || 'artifactory-edge-dev' }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
+          development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
         # yamllint enable rule:line-length
 
     - name: Configure uv authentication

From f335f47fa10fc0ed2252014f81ca133c2e0a5b8e Mon Sep 17 00:00:00 2001
From: Hedi Nasr <hedi.nasr@sonarsource.com>
Date: Thu, 8 Oct 2026 14:08:15 +0200
Subject: [PATCH 2/2] BUILD-12911: Keep dev Edge resolve tokens on dev Vault

Production Vault issues only production Edge tokens. The dev Edge keeps its seeded artifactory-edge-dev engine on dev Vault.
---
 README.md                | 11 ++---------
 build-gradle/action.yml  |  3 +--
 build-maven/action.yml   |  3 +--
 build-npm/action.yml     |  3 +--
 build-poetry/action.yml  |  3 +--
 build-yarn/action.yml    |  5 ++---
 config-gradle/action.yml |  5 ++---
 config-maven/action.yml  |  5 ++---
 config-npm/action.yml    |  5 ++---
 config-nuget/action.yml  |  5 ++---
 config-pip/action.yml    |  5 ++---
 config-poetry/action.yml |  5 ++---
 config-uv/action.yml     |  5 ++---
 13 files changed, 22 insertions(+), 41 deletions(-)

diff --git a/README.md b/README.md
index e6ba1d3a..711b417b 100644
--- a/README.md
+++ b/README.md
@@ -71,17 +71,10 @@ These badges show the status of workflows in dummy repositories that use (or sho
 
 The actions resolve, deploy and promote on SaaS Repox (`https://repox.jfrog.io`) by default. To resolve dependencies through
 the production JFrog Edge instead, set `repox-url: https://repox-internal.sonar.build` on the `config-*` and `build-*` actions.
-Use `https://repox-internal.dev.sonar.build` for the dev Edge.
 
 - Deployment, publication, build info and promotion always use `https://repox.jfrog.io`: the Edge is read-only.
-- Resolve credentials always come from production Vault (`https://vault.sonar.build`). SaaS uses
-  `development/artifactory`; dev Edge uses `development/artifactory-edge-dev`; production Edge uses
-  `development/artifactory-edge-prod`. Edge reader tokens are issued directly by the corresponding Edge.
-- The internal Edge hostnames are only reachable from runners inside the SonarSource network. Their public aliases
-  `repox.dev.sonar.build` and `repox.sonar.build` select the same dev and production engines, respectively.
-- Before adopting these actions for either Edge, its production Vault engine must be seeded and configured.
-  Keep older action versions on dev Vault until migration completes. To return resolution to SaaS, set
-  `repox-url: https://repox.jfrog.io`.
+- The internal Edge hostname is only reachable from runners inside the SonarSource network.
+- To return resolution to SaaS, set `repox-url: https://repox.jfrog.io`.
 
 ---
 
diff --git a/build-gradle/action.yml b/build-gradle/action.yml
index e4fd7b50..6c5ec19b 100644
--- a/build-gradle/action.yml
+++ b/build-gradle/action.yml
@@ -45,8 +45,7 @@ inputs:
       for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
diff --git a/build-maven/action.yml b/build-maven/action.yml
index bb302899..824645bb 100644
--- a/build-maven/action.yml
+++ b/build-maven/action.yml
@@ -55,8 +55,7 @@ inputs:
     description: Maven flags for all subsequent mvn calls
     default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
diff --git a/build-npm/action.yml b/build-npm/action.yml
index 3f7d8d13..8477d3bf 100644
--- a/build-npm/action.yml
+++ b/build-npm/action.yml
@@ -33,8 +33,7 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
diff --git a/build-poetry/action.yml b/build-poetry/action.yml
index 82715220..0bf9af8e 100644
--- a/build-poetry/action.yml
+++ b/build-poetry/action.yml
@@ -31,8 +31,7 @@ inputs:
     description: Path to the Poetry cache directory, relative to GitHub workspace.
     default: .cache/pypoetry
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
diff --git a/build-yarn/action.yml b/build-yarn/action.yml
index 07a1127e..6b10f3ed 100644
--- a/build-yarn/action.yml
+++ b/build-yarn/action.yml
@@ -36,8 +36,7 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache Yarn dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
@@ -134,7 +133,7 @@ runs:
       id: artifactory
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
diff --git a/config-gradle/action.yml b/config-gradle/action.yml
index a4210f22..6c73baa1 100644
--- a/config-gradle/action.yml
+++ b/config-gradle/action.yml
@@ -10,8 +10,7 @@ inputs:
       and `public-reader` for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
@@ -96,7 +95,7 @@ runs:
       id: artifactory
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
diff --git a/config-maven/action.yml b/config-maven/action.yml
index a60cbf71..90c7452f 100644
--- a/config-maven/action.yml
+++ b/config-maven/action.yml
@@ -13,8 +13,7 @@ inputs:
     description: Maven flags for all subsequent mvn calls
     default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
@@ -97,7 +96,7 @@ runs:
       id: artifactory
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
diff --git a/config-npm/action.yml b/config-npm/action.yml
index e659824c..54f70b87 100644
--- a/config-npm/action.yml
+++ b/config-npm/action.yml
@@ -16,8 +16,7 @@ inputs:
     description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
     default: 'true'
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   host-actions-root:
     description: Path to the actions folder on the host (used when called from another local action)
@@ -95,7 +94,7 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
diff --git a/config-nuget/action.yml b/config-nuget/action.yml
index b60ae8cb..4d11d004 100644
--- a/config-nuget/action.yml
+++ b/config-nuget/action.yml
@@ -13,8 +13,7 @@ inputs:
       for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
 
 runs:
@@ -31,7 +30,7 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
diff --git a/config-pip/action.yml b/config-pip/action.yml
index 6a1345ca..188225f5 100644
--- a/config-pip/action.yml
+++ b/config-pip/action.yml
@@ -11,8 +11,7 @@ inputs:
       for public repositories.
     default: ''
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   cache-paths:
     description: Cache paths to use (multiline).
@@ -77,7 +76,7 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
diff --git a/config-poetry/action.yml b/config-poetry/action.yml
index 7cd2234e..d0593c63 100644
--- a/config-poetry/action.yml
+++ b/config-poetry/action.yml
@@ -13,8 +13,7 @@ inputs:
     description: PyPI virtual repository to resolve dependencies from
     default: sonarsource-pypi
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   poetry-virtualenvs-path:
     description: Path to the Poetry virtual environments, relative to GitHub workspace. The folder is cached only if it is a subdirectory of
@@ -120,7 +119,7 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
diff --git a/config-uv/action.yml b/config-uv/action.yml
index c1c3dddb..5f4ea32f 100644
--- a/config-uv/action.yml
+++ b/config-uv/action.yml
@@ -13,8 +13,7 @@ inputs:
     description: Name of the uv index in pyproject.toml to authenticate (e.g. repox for `[[tool.uv.index]]` with `name = "repox"`)
     default: repox
   repox-url:
-    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge
-      or https://repox-internal.dev.sonar.build for the dev Edge.
+    description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
     default: https://repox.jfrog.io
   uv-cache-dir:
     description: Path to the uv cache directory, relative to GitHub workspace
@@ -108,7 +107,7 @@ runs:
       id: secrets
       with:
         # yamllint disable rule:line-length
-        url: https://vault.sonar.build
+        url: ${{ contains(inputs.repox-url, '.dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
         secrets: |
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/${{ contains(inputs.repox-url, 'jfrog.io') && 'artifactory' || (contains(inputs.repox-url, '.dev.sonar.build') && 'artifactory-edge-dev' || 'artifactory-edge-prod') }}/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;