[bwalsh434]

BUILD-12912: Actions that already expose repox-url now resolve dependencies through https://repox-internal.sonar.build by default. Explicit SaaS and dev Edge overrides remain supported. Updates all 12 input defaults and their documentation; deployment, publication, build info, and promotion continue using SaaS Repox.

Ticket: https://sonarsource.atlassian.net/browse/BUILD-12912

Dependencies and release prerequisites

Stacked on #357 for production Vault routing and Edge-issued reader tokens. Merge that dependency first, then retarget this PR to master. Keep this PR in draft until the production Edge Vault engine is seeded and configured and authenticated downloads have been validated from the intended runners. Runners need access to the internal endpoint; callers without that access must explicitly select repox-url: https://repox.jfrog.io.

Test plan

• Passed all 47 focused ShellSpec examples for npm, pip, Poetry, uv, and NuGet configuration.
• Verified all 12 existing action defaults and unchanged caller input forwarding by parsing the YAML manifests.
• Passed applicable pre-commit checks, including strict YAML and Markdown linting.
• Passed DEEP analysis of all 13 modified files with no issues.
• Before release, run representative workflows without a repox-url override against the production Edge and validate private dependency authentication; repeat with explicit SaaS and dev Edge overrides.

CI tooling setup

The shell tests, release-channel schema validation, and build-number aggregation explicitly use SaaS Repox for their config-npm tooling setup. These jobs validate unrelated functionality and can run before production Edge activation. The action defaults remain on the production Edge; authenticated default-endpoint integration validation is still required before release.

[bwalsh434]

[From Codex] Confirmed Gitar's Vault-access finding in both failing jobs: production Vault denies development/artifactory-edge-prod/token/SonarSource-ci-github-actions-public-reader. The required mount/role/policy preparation and activation are already covered by https://github.com/SonarSource/re-terraform-aws-vault/pull/9759 and https://github.com/SonarSource/re-terraform-aws-vault/pull/9760 under BUILD-12911. This PR remains draft with [DO NOT MERGE] and is stacked on #357. Apply the preparation, bootstrap and activation sequence, then rerun the default-endpoint integration checks. No additional policy change belongs in this repository, and an SaaS override in those tests would bypass the new default we need to validate.

[bwalsh434]

[From Codex] Updated the three failing workflows to explicitly use SaaS Repox for npm tooling setup. This lets shell tests, schema validation, and build-number aggregation run before Edge activation. All 12 action defaults remain on the production Edge. Workflow schema validation, strict YAML lint and actionlint pass locally; authenticated default-endpoint validation remains a release prerequisite. CI is rerunning.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[bwalsh434]

Closing this PR in favor of #359

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Twelve actions switch default dependency resolution from SaaS to the production Edge.

Defaults Repox resolution to the production Edge for 12 actions that expose repox-url, while preserving explicit SaaS and dev Edge overrides. All 47 ShellSpec tests pass, YAML manifests are verified, and DEEP analysis found no issues. No issues found.

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}