[hedinasr]

BUILD-12980: Default dependency resolution to the production JFrog Edge on self-hosted runners while preserving SaaS defaults on GitHub-hosted runners.

Behavior

• Select the omitted repox-url from runner.environment: GitHub-hosted runners use https://repox.jfrog.io; self-hosted runners use https://repox-internal.sonar.build.
• Apply the same rule to all 12 config/build actions. Build actions forward the selected endpoint to their configuration action; Maven's own resolve URL and Gradle's plugin repository use that endpoint too.
• Preserve explicit repox-url overrides for SaaS, dev Edge and Prod Edge, with the existing matching Vault server and reader-token engine.
• Keep deployment, publication, build info and promotion on SaaS. The Gradle fallback outside these actions also remains on SaaS.
• Rewrite NuGet sources to the selected endpoint. Document the runner defaults, overrides and Edge prerequisites in the README.

Validation

• Passed 504 cases evaluated from the actual manifests with GitHub's @actions/expressions engine: both runner environments, omitted/default and explicit endpoints, public/private/custom reader roles, wrapper forwarding, Vault/engine selection, Maven resolution and Gradle plugin resolution.
• Passed 47 existing package-configuration tests covering npm, pip, Poetry, uv and NuGet.
• Passed applicable pre-commit hooks and git diff --check. Compared parsed manifests with the previous commit to confirm only the input descriptions/defaults changed in this new commit.
• Earlier production Edge pilot: https://github.com/SonarSource/sonarcloud-core/pull/11364 and https://github.com/SonarSource/sonarcloud-core/actions/runs/38233844533, pinned to 51cbf99. It covered Gradle, uv, npm and Maven configuration, production reader issuance, recent private content and SaaS deployment/build info. It predates the runner compatibility commit and does not validate that commit's runtime default selection.

Test plan before merge and release

• Pilot the final candidate on a GitHub-hosted runner with no override and confirm SaaS resolution and SaaS reader issuance.
• Pilot the final candidate on an internal self-hosted runner with no override and confirm production Edge resolution and production Edge reader issuance.
• Exercise explicit SaaS and supported dev/production Edge overrides with authenticated downloads, including a composite/build wrapper.
• Complete representative authenticated runs for Yarn, Poetry, pip, NuGet and the build wrappers not covered by the earlier pilot.
• Confirm deployment, publication, build info and promotion still target SaaS in representative live runs.
• Explain and repeatedly validate the earlier pilot's transient Edge 403; the successful rerun alone does not establish the cause.

Rollout and remaining compatibility work

Plan: https://sonarsource.atlassian.net/browse/BUILD-12988
Execution: https://sonarsource.atlassian.net/browse/BUILD-12989

The distribution branch is v2. @master consumers adopt the change at merge; @v2 consumers adopt it when the release branch advances. Keep this PR in draft until the applicable merge-time gates are validated.

GitHub-hosted consumers need no individual SaaS override when repox-url is omitted. Self-hosted consumers without internal Edge access still need an explicit SaaS override. Classify matrix and inherited composite runners by their actual runner.environment and verify Edge access where selected.

• Validate the GitHub-hosted sonar-dummy-python-oss workflows on the final candidate; their default now stays on SaaS without workflow edits.
• Update sonar-dummy-gradle-oss's hardcoded SaaS QA download assertion to use the configured resolve endpoint, and validate its runner variants.
• Validate self-hosted default consumers and explicit overrides using the full @master/@v2 consumer register in the rollout plan. Existing @v1 callers are outside this release cohort.
• Require consumers resolving through Edge in Orchestrator tests to use a release recognizing repox-internal.sonar.build as an authenticated SonarSource host, or explicitly retain SaaS. Validate private downloads and version aliases.
• Align hardcoded uv indexes/lockfiles and independently supplied credentials with the selected endpoint. Existing explicit dev Edge overrides retain their endpoint and dev Vault routing.
• Publish the reviewed release, advance v2 to its tested tag and announce it through the xtranet release process. Rollback uses a reviewed revert PR followed by a corrective release and v2 update; reverting master alone does not restore @v2 consumers.

[hashicorp-vault-sonar-prod]

BUILD-12980

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 11 closed / 11 findings

🟡 Medium risk · Switching self-hosted dependency resolution to production Edge by default may break private downloads when runners lack Edge access or matching credentials.

Defaults dependency resolution to the production JFrog Edge on self-hosted runners while keeping SaaS on GitHub-hosted runners, across all 12 config/build actions. Resolved findings cover the Edge prerequisite documentation, GitHub-hosted Maven/Gradle/Poetry paths that were hitting Edge, the sonar-dummy-python-oss regression on @master, the composite config-pip Edge resolution, and the sonar-dummy-gradle-oss QA grep assertion. No open findings remain.

✅ 11 closed

✅ Bug: Edge default reaches orchestrator ITs with no prerequisite documented

📄 README.md:70-77 📄 config-maven/action.yml:15-17 📄 config-maven/action.yml:123 📄 build-maven/action.yml:136-150
This PR makes https://repox-internal.sonar.build the default repox-url. So every config-*/build-* caller now gets ARTIFACTORY_URL=https://repox-internal.sonar.build/artifactory and an Edge token in GITHUB_ENV, not only pilot repos that opt in. A previous accepted review flagged that orchestrator's Artifactory host check (ArtifactoryFactory.isSonarSourceArtifactory) only recognises repox.jfrog.io and repox-internal.dev.sonar.build. Under that check, orchestrator-based ITs treat the production Edge as a plain unauthenticated Maven repo, and DEV/LATEST_RELEASE alias resolution and private artifact downloads fail. I could not confirm whether a newer orchestrator release has fixed this. Still, the README Edge section (lines 70-77) has no note that repos running orchestrator ITs need an orchestrator version that recognises the new host, and the PR's breaking-change notice mentions only network reachability. With this flip, the problem moves from opt-in pilots to every caller by default. Add that prerequisite to the README and the release notice, or wait for the orchestrator fix (add repox-internal.sonar.build to the recognised hosts) to be released before changing the default.

✅ Cross-Repo: cloud-native-gradle-modules: build-gradle on GitHub-hosted runner hits Edge

📄 build-gradle/action.yml:48-49 📄 README.md:72-77
Fix here and in SonarSource/cloud-native-gradle-modules

Breaks in: SonarSource/cloud-native-gradle-modules - .github/workflows/build.yml - build job (SonarSource/ci-github-actions/build-gradle@v2 step)

With this PR, build-gradle defaults repox-url to https://repox-internal.sonar.build. SonarSource/cloud-native-gradle-modules calls build-gradle@v2 without repox-url in .github/workflows/build.yml (build job) and shadow-scan.yml, on github-ubuntu-latest-s. This repo's README calls that label a GitHub-hosted runner, and the Edge is only reachable inside the SonarSource network. Once this ships, Gradle dependency resolution in those jobs will fail. The PR means to make this break, so the consumer has to opt out before it picks up the release.

Here: Before release, list this repository in the BUILD-12980 rollout notice. Alternatively, keep GitHub-hosted runners on SaaS: make the default empty and derive the URL from runner.environment == 'github-hosted', as config-maven already does for UseContainerSupport.

There: In .github/workflows/build.yml (build job) and shadow-scan.yml, set repox-url: https://repox.jfrog.io on the SonarSource/ci-github-actions/build-gradle@v2 step.

In SonarSource/cloud-native-gradle-modules - .github/workflows/build.yml:

- uses: SonarSource/ci-github-actions/build-gradle@v2
  with:
    repox-url: https://repox.jfrog.io

✅ Cross-Repo: sonar-classloader: build-maven on GitHub-hosted runner resolves via Edge

📄 build-maven/action.yml:58-59
Fix here and in SonarSource/sonar-classloader

Breaks in: SonarSource/sonar-classloader - .github/workflows/build.yml - build job (SonarSource/ci-github-actions/build-maven@v1 step)

build-maven now defaults repox-url to https://repox-internal.sonar.build. SonarSource/sonar-classloader's .github/workflows/build.yml build job calls build-maven@v1 with no repox-url on github-ubuntu-latest-s, which this README describes as GitHub-hosted. Maven resolution will target a host that only resolves inside the SonarSource network, so the build fails once the release reaches v1.

Here: Before release, tell this repository about the change through the BUILD-12980 rollout notice. Alternatively, fall back to https://repox.jfrog.io when runner.environment == 'github-hosted' and no explicit repox-url is given.

There: In .github/workflows/build.yml (build job), add repox-url: https://repox.jfrog.io to the build-maven@v1 step.

In SonarSource/sonar-classloader - .github/workflows/build.yml:

- uses: SonarSource/ci-github-actions/build-maven@v1
  with:
    repox-url: https://repox.jfrog.io

✅ Cross-Repo: rspec-maven-plugin: build-maven on github-ubuntu-latest-m hits Edge

📄 build-maven/action.yml:58-59
Fix here and in SonarSource/rspec-maven-plugin

Breaks in: SonarSource/rspec-maven-plugin - .github/workflows/build.yml - build job (SonarSource/ci-github-actions/build-maven@v2 step)

build-maven now defaults repox-url to the production Edge https://repox-internal.sonar.build. SonarSource/rspec-maven-plugin's .github/workflows/build.yml build job calls build-maven@v2 without repox-url on github-ubuntu-latest-m, a GitHub-hosted label. That runner can't reach the Edge, so Maven resolution fails after release.

Here: Add this repository to the BUILD-12980 rollout notice, or fall back to SaaS Repox when runner.environment == 'github-hosted' and repox-url is not set.

There: In .github/workflows/build.yml (build job), set repox-url: https://repox.jfrog.io on the build-maven@v2 step.

In SonarSource/rspec-maven-plugin - .github/workflows/build.yml:

- uses: SonarSource/ci-github-actions/build-maven@v2
  with:
    repox-url: https://repox.jfrog.io

✅ Cross-Repo: sonar-update-center: build-maven jobs on GitHub-hosted runner hit Edge

📄 build-maven/action.yml:58-59
Fix here and in SonarSource/sonar-update-center

Breaks in: SonarSource/sonar-update-center - .github/workflows/build.yml - build job (SonarSource/ci-github-actions/build-maven@v1 step)

SonarSource/sonar-update-center's .github/workflows/build.yml and unified-dogfooding.yml call build-maven@v1 without repox-url on github-ubuntu-latest-s. With this PR's new default (https://repox-internal.sonar.build, reachable only inside the SonarSource network), Maven resolution in both workflows fails on that GitHub-hosted runner.

Here: Add this repository to the BUILD-12980 rollout notice, or fall back to SaaS Repox on github-hosted runners when repox-url is not given explicitly.

There: Add repox-url: https://repox.jfrog.io to the build-maven@v1 steps in .github/workflows/build.yml and unified-dogfooding.yml.

In SonarSource/sonar-update-center - .github/workflows/build.yml:

- uses: SonarSource/ci-github-actions/build-maven@v1
  with:
    repox-url: https://repox.jfrog.io

...and 6 more closed from earlier reviews

Verification Rules 2/2 met Knowledge ✅ 7 · 🔎 1 Repos 5 inspected · PRs 3 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Knowledge ✅ 7 expectations met 🔎 1 informed a finding

build-gradle input repox-url default https://repox-internal.sonar.build: dependency with SonarSource/cloud-native-gradle-modules expectation met
build-maven input repox-url default https://repox-internal.sonar.build: dependency with SonarSource/rspec-maven-plugin expectation met
build-maven input repox-url default https://repox-internal.sonar.build: dependency with SonarSource/sonarqube-roslyn-sdk-template-plugin expectation met
config-maven / build-maven input repox-url default https://repox-internal.sonar.build: dependency with SonarSource/reddeer expectation met
config-pip / build-poetry input repox-url default https://repox-internal.sonar.build: dependency with SonarSource/sonar-dummy-python-oss expectation met

3 more knowledge results

Broader impact Repos 5 inspected PRs 3 inspected

Cross-repo 5 repositories inspected 0 open impacts

SonarSource/sonar-dummy-gradle-oss Inspected
SonarSource/sonar-dummy-python-oss Inspected
SonarSource/sonar-dummy-js Inspected
SonarSource/sonar-java Inspected
SonarSource/sonar-plugin-api Inspected

Cross-PR 3 PRs inspected 0 open impacts

PR #317: BUILD-11784 Route the Gradle buildscript classpath through Repox in config-gradle Inspected
PR #2301: TEST - fix uv/repox 401 in serializer-runner (do not merge, port to sonar-python-enterprise) Inspected
PR #3506: BUILD-12990: Migrate Orchestrator downloads to production Edge Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[hedinasr]

Gitar fix CI

[gitar-bot]

Gitar fix CI

On it. I'm working on fixing the CI failure and will push the changes shortly.

[jayadeep-km-sonarsource]

Approving to unblock the effort. I don't have enough context for a critical review on this one.