diff --git a/README.md b/README.md
index 711b417b..39621176 100644
--- a/README.md
+++ b/README.md
@@ -69,12 +69,28 @@ These badges show the status of workflows in dummy repositories that use (or sho
## Resolving through the JFrog Edge
-The actions resolve, deploy and promote on SaaS Repox (`https://repox.jfrog.io`) by default. To resolve dependencies through
-the production JFrog Edge instead, set `repox-url: https://repox-internal.sonar.build` on the `config-*` and `build-*` actions.
+The `config-*` and `build-*` actions select the dependency resolve endpoint from `runner.environment` when `repox-url` is omitted:
-- Deployment, publication, build info and promotion always use `https://repox.jfrog.io`: the Edge is read-only.
+- GitHub-hosted runners use SaaS Repox (`https://repox.jfrog.io`).
+- Self-hosted runners use the production JFrog Edge (`https://repox-internal.sonar.build`).
+- An explicit `repox-url` always overrides runner selection, including SaaS, dev Edge and production Edge URLs.
+
+The selected URL also determines the matching Vault server and reader-token engine.
+
+- Deployment, publication, build info and promotion always use SaaS Repox (`https://repox.jfrog.io`): the Edge is read-only.
- The internal Edge hostname is only reachable from runners inside the SonarSource network.
-- To return resolution to SaaS, set `repox-url: https://repox.jfrog.io`.
+- Self-hosted runners without internal Edge connectivity must set `repox-url: https://repox.jfrog.io` on every affected `config-*`
+ and `build-*` action, including actions called through composite wrappers. GitHub-hosted runners with internal connectivity can
+ explicitly select `repox-url: https://repox-internal.sonar.build`.
+- Repositories resolving through Edge during Orchestrator-based integration tests need an Orchestrator release that recognizes
+ `repox-internal.sonar.build` as a SonarSource Artifactory host. Until they adopt that release, set
+ `repox-url: https://repox.jfrog.io` to preserve authenticated private downloads and version alias resolution.
+- Match hardcoded package indexes and credentials to the selected `repox-url`. For example, update a named uv index and its
+ lockfile when moving to the Edge, and avoid overwriting Edge credentials with independently fetched SaaS tokens.
+- Consumers following `@master` must complete these prerequisites before the default change merges; consumers following a
+ release branch such as `@v2` must complete them before that branch is updated. Update tests that assert a download URL to
+ use the configured resolve URL instead of a hardcoded SaaS hostname.
+- To resolve from SaaS Repox instead, set `repox-url: https://repox.jfrog.io`.
---
@@ -266,7 +282,7 @@ steps:
| `working-directory` | Relative path under github.workspace to execute the build in | `.` |
| `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos |
| `common-mvn-flags` | Maven flags for all subsequent mvn calls | `--batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `use-develocity` | Whether to use Develocity for build tracking | `false` |
| `develocity-url` | URL for Develocity | `https://develocity.sonar.build/` |
| `cache-paths` | Custom cache paths (multiline). | (optional) |
@@ -372,7 +388,7 @@ See also [`config-maven`](#config-maven) input environment variables.
| `skip-build` | If `true`, analyze existing `target/` output without compiling, testing or deploying. Requires `deploy: false`. | `false` |
| `maven-args` | Additional arguments to pass to Maven | (optional) |
| `scanner-java-opts` | Additional Java options for the Sonar scanner (`SONAR_SCANNER_JAVA_OPTS`) | `-Xmx512m` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `use-develocity` | Whether to use Develocity for build tracking | `false` |
| `develocity-url` | URL for Develocity | `https://develocity.sonar.build/` |
| `sonar-platform` | SonarQube primary platform - 'next', 'sqc-eu', 'sqc-us', or 'none'. Use 'none' to skip sonar scans | `next` |
@@ -514,7 +530,7 @@ See also [`get-build-number`](#get-build-number) input environment variables.
| `working-directory` | Relative path under github.workspace to execute the build in | `.` |
| `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos |
| `artifactory-pypi-repo` | PyPI virtual repository to resolve dependencies from | `sonarsource-pypi` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `poetry-virtualenvs-path` | Path to the Poetry virtual environments, relative to GitHub workspace | `.cache/pypoetry/virtualenvs` |
| `poetry-cache-dir` | Path to the Poetry cache directory, relative to GitHub workspace | `.cache/pypoetry` |
| `disable-caching` | Whether to disable Poetry caching entirely | `false` |
@@ -616,7 +632,7 @@ See also [`config-poetry`](#config-poetry) input environment variables.
| `deploy-pull-request` | Whether to also deploy pull request artifacts. If `deploy` is `false`, this has no effect | `false` |
| `poetry-virtualenvs-path` | Path to the Poetry virtual environments, relative to GitHub workspace | `.cache/pypoetry/virtualenvs` |
| `poetry-cache-dir` | Path to the Poetry cache directory, relative to GitHub workspace | `.cache/pypoetry` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `sonar-platform` | SonarQube primary platform - 'next', 'sqc-eu', sqc-us, or 'none'. Use 'none' to skip sonar scans | `next` |
| `run-shadow-scans` | If true, run sonar scanner on all 3 platforms using the provided URL and token. If false, run on the platform provided by sonar-platform. When enabled, the sonar-platform setting is ignored | `false` |
| `working-directory` | Relative path under github.workspace to execute the build in | `.` |
@@ -728,7 +744,7 @@ If provided, `SONARSOURCE_REPOSITORY` is used at runtime by the Gradle init scri
| `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos |
| `use-develocity` | Whether to use Develocity for build tracking | `false` |
| `develocity-url` | URL for Develocity | `https://develocity.sonar.build/` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `cache-paths` | Custom cache paths (multiline). | `~/.gradle/caches`
`~/.gradle/wrapper` |
| `disable-caching` | Whether to disable Gradle caching entirely | `false` |
@@ -851,7 +867,7 @@ See also [`config-gradle`](#config-gradle) input environment variables.
| `use-develocity` | Whether to use Develocity for build tracking | `false` |
| `gradle-args` | Additional arguments to pass to Gradle | (optional) |
| `develocity-url` | URL for Develocity | `https://develocity.sonar.build/` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `sonar-platform` | SonarQube variant - 'next', 'sqc-eu', 'sqc-us', or 'none'. Use 'none' to skip sonar scans | `next` |
| `working-directory` | Relative path under github.workspace to execute the build in | `.` |
| `run-shadow-scans` | Enable analysis across all 3 SonarQube platforms (unified platform dogfooding) | `false` |
@@ -1050,7 +1066,7 @@ See also [`get-build-number`](#get-build-number) input environment variables.
| `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos |
| `disable-caching` | Whether to disable NPM caching entirely | `false` |
| `cache-npm` | Deprecated. Use `disable-caching: 'true'` instead | `true` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
### Outputs
@@ -1143,7 +1159,7 @@ See also [`config-npm`](#config-npm) input environment variables.
| `skip-tests` | Whether to skip running tests | `false` |
| `disable-caching` | Whether to disable NPM caching entirely | `false` |
| `cache-npm` | Deprecated. Use `disable-caching: 'true'` instead | `true` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `sonar-platform` | SonarQube primary platform - 'next', 'sqc-eu', or 'sqc-us' | `next` |
| `run-shadow-scans` | Enable analysis across all 3 SonarQube platforms (unified platform dogfooding) | `false` |
| `build-name` | Name of the JFrog build to publish. | `` |
@@ -1255,7 +1271,7 @@ jobs:
| `skip-tests` | Whether to skip running tests | `false` |
| `disable-caching` | Whether to disable Yarn caching entirely | `false` |
| `cache-yarn` | Deprecated. Use `disable-caching: 'true'` instead | `true` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `sonar-platform` | SonarQube primary platform - 'next', 'sqc-eu', 'sqc-us', or 'none'. Use 'none' to skip sonar scans | `next` |
| `run-shadow-scans` | Enable analysis across all 3 SonarQube platforms (unified platform dogfooding) | `false` |
| `provenance` | Whether to generate provenance attestation for built artifacts | `false` |
@@ -1338,7 +1354,7 @@ steps:
|---------------------------|-----------------------------------------------------------------------------|----------------------------------------------------------------------|
| `working-directory` | Relative path under github.workspace to execute the build in | `.` |
| `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `cache-paths` | Cache paths to use (multiline) | `~/.cache/pip` |
| `disable-caching` | Whether to disable pip caching entirely | `false` |
@@ -1440,7 +1456,7 @@ For build-info collection, pass `--build-name` and `--build-number` to `jf uv` a
| `working-directory` | Relative path under github.workspace to execute the build in | `.` |
| `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos |
| `uv-index-name` | Name of the uv index in `pyproject.toml` to authenticate | `repox` |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
| `uv-cache-dir` | Path to the uv cache directory, relative to GitHub workspace | `.cache/uv` |
| `disable-caching` | Whether to disable uv caching entirely | `false` |
@@ -1469,7 +1485,7 @@ See also [`get-build-number`](#get-build-number) output environment variables.
Configure NuGet authentication and resolve the Repox package sources of NuGet configuration files through `repox-url`.
The action reads a Repox reader token from Vault and exports it as `ARTIFACTORY_USER` and `ARTIFACTORY_PASSWORD`, the variables
-referenced by the `packageSourceCredentials` of the NuGet configuration files. With a `repox-url` other than `https://repox.jfrog.io`,
+referenced by the `packageSourceCredentials` of the NuGet configuration files. Unless `repox-url` is `https://repox.jfrog.io`,
every package source `value` starting with `https://repox.jfrog.io/artifactory/` in the listed files is rewritten to `repox-url`,
so the committed files can keep SaaS Repox for local builds. Other attributes, such as `trustedSigners` service indexes, are unchanged.
@@ -1515,7 +1531,7 @@ steps:
| `nuget-config-files` | NuGet configuration files to update (multiline), relative to `working-directory` | `NuGet.Config` |
| `working-directory` | Relative path under github.workspace to execute the action in | `.` |
| `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos |
-| `repox-url` | URL for Repox | `https://repox.jfrog.io` |
+| `repox-url` | URL for Repox | Runner-dependent (see Edge section) |
### Output Environment Variables
diff --git a/build-gradle/action.yml b/build-gradle/action.yml
index 0a4f847b..ed7043ef 100644
--- a/build-gradle/action.yml
+++ b/build-gradle/action.yml
@@ -45,8 +45,9 @@ inputs:
for public repositories.
default: ''
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
use-develocity:
description: Whether to use Develocity for build tracking.
default: 'false'
diff --git a/build-maven/action.yml b/build-maven/action.yml
index 0ab495fb..e36fa1ca 100644
--- a/build-maven/action.yml
+++ b/build-maven/action.yml
@@ -55,8 +55,9 @@ inputs:
description: Maven flags for all subsequent mvn calls
default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
use-develocity:
description: Whether to use Develocity for build tracking.
default: 'false'
diff --git a/build-npm/action.yml b/build-npm/action.yml
index a57abaa3..de0473a0 100644
--- a/build-npm/action.yml
+++ b/build-npm/action.yml
@@ -33,8 +33,9 @@ inputs:
description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
default: 'true'
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
sonar-platform:
description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
default: next
diff --git a/build-poetry/action.yml b/build-poetry/action.yml
index 13ceef84..88e74417 100644
--- a/build-poetry/action.yml
+++ b/build-poetry/action.yml
@@ -31,8 +31,9 @@ inputs:
description: Path to the Poetry cache directory, relative to GitHub workspace.
default: .cache/pypoetry
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
sonar-platform:
description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
default: next
diff --git a/build-yarn/action.yml b/build-yarn/action.yml
index f5a7128c..2214ed04 100644
--- a/build-yarn/action.yml
+++ b/build-yarn/action.yml
@@ -36,8 +36,9 @@ inputs:
description: Deprecated. Use `disable-caching` instead. Whether to cache Yarn dependencies.
default: 'true'
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
sonar-platform:
description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
default: next
diff --git a/config-gradle/action.yml b/config-gradle/action.yml
index bd39922b..4a4416f2 100644
--- a/config-gradle/action.yml
+++ b/config-gradle/action.yml
@@ -10,8 +10,9 @@ inputs:
and `public-reader` for public repositories.
default: ''
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
use-develocity:
description: Whether to use Develocity for build tracking.
default: 'false'
diff --git a/config-maven/action.yml b/config-maven/action.yml
index ebf64922..a2cdcb4e 100644
--- a/config-maven/action.yml
+++ b/config-maven/action.yml
@@ -13,8 +13,9 @@ inputs:
description: Maven flags for all subsequent mvn calls
default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
use-develocity:
description: Whether to use Develocity for build tracking.
default: 'false'
diff --git a/config-npm/action.yml b/config-npm/action.yml
index 504d239d..2f4d724d 100644
--- a/config-npm/action.yml
+++ b/config-npm/action.yml
@@ -16,8 +16,9 @@ inputs:
description: Deprecated. Use `disable-caching` instead. Whether to cache NPM dependencies.
default: 'true'
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
host-actions-root:
description: Path to the actions folder on the host (used when called from another local action)
default: ''
diff --git a/config-nuget/action.yml b/config-nuget/action.yml
index 1ec3c2cc..0cccff99 100644
--- a/config-nuget/action.yml
+++ b/config-nuget/action.yml
@@ -13,8 +13,9 @@ inputs:
for public repositories.
default: ''
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
runs:
using: composite
diff --git a/config-pip/action.yml b/config-pip/action.yml
index ccbb5995..f6aa4dbf 100644
--- a/config-pip/action.yml
+++ b/config-pip/action.yml
@@ -11,8 +11,9 @@ inputs:
for public repositories.
default: ''
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
cache-paths:
description: Cache paths to use (multiline).
default: ~/.cache/pip
diff --git a/config-poetry/action.yml b/config-poetry/action.yml
index 929801d6..f027428b 100644
--- a/config-poetry/action.yml
+++ b/config-poetry/action.yml
@@ -13,8 +13,9 @@ inputs:
description: PyPI virtual repository to resolve dependencies from
default: sonarsource-pypi
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
poetry-virtualenvs-path:
description: Path to the Poetry virtual environments, relative to GitHub workspace. The folder is cached only if it is a subdirectory of
`poetry-cache-dir`.
diff --git a/config-uv/action.yml b/config-uv/action.yml
index affb77d3..187a3734 100644
--- a/config-uv/action.yml
+++ b/config-uv/action.yml
@@ -13,8 +13,9 @@ inputs:
description: Name of the uv index in pyproject.toml to authenticate (e.g. repox for `[[tool.uv.index]]` with `name = "repox"`)
default: repox
repox-url:
- description: URL for Repox used to resolve dependencies. Use https://repox-internal.sonar.build for the production JFrog Edge.
- default: https://repox.jfrog.io
+ description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
+ on self-hosted runners. Explicit URLs override runner selection.
+ default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
uv-cache-dir:
description: Path to the uv cache directory, relative to GitHub workspace
default: .cache/uv