[bwalsh434]

BUILD-13094: Keep dependency downloads and Orchestrator runtime downloads on the endpoint matching the action-managed reader.

QA callers currently override the shared action's reader with a SaaS credential. Remove those overrides and the unused Vault reader fetches. Forward ARTIFACTORY_RESOLVE_URL to test JVMs as orchestrator.artifactory.url: build-gradle keeps ARTIFACTORY_URL on SaaS for deployment, so removing the credential override alone would otherwise leave Orchestrator using a SaaS URL with an Edge token.

Orchestrator is already at 6.4.4.4797.

Shared-action dependency:
SonarSource/ci-github-actions#359

Prepare this as a prerequisite for the shared rollout. This repository follows @v2: it must land before v2 advances to the shared-action release. Merging the shared-action PR into master alone does not change this repository's action calls.

Parent rollout:
https://sonarsource.atlassian.net/browse/BUILD-12980

QA reader choice

The three explicit Orchestrator QA callers (qa_plugin, qa_ruling, qa_pr_analysis) intentionally request the action-managed private-reader. The public repository default would otherwise select public-reader: live production probes show HTTP403 for the optional org.eclipse.lsp4j.jsonrpc:1.0.0 Gradle metadata under that reader, which stops resolution. The private reader returns the correct HTTP404 for absent optional metadata and HTTP200 for the required POM/JAR, and it can read the Enterprise distribution used by QA. This is an explicit supported role input, not a manual credential override.

The affected dependency belongs only to integrationTestImplementation; the repository's integration-test task is independent of ordinary build/check, so the reader change is limited to these three QA callers. Ordinary Build/TestAnalyze/Windows-build paths retain their existing reader selection. Current @v2 CI and the production-aware pilot both pass with this scoped change.

Validation

• Passed workflow parsing and actionlint with the organization's custom runner labels configured.
• Passed real Gradle test-JVM probes with no resolve override, SaaS resolution and Prod Edge resolution; the deployment URL stays on SaaS in each case.
• Passed deterministic secrets scanning and git diff --check.

Test plan

• Applicable PR CI and Gitar pass on the final commit.
• Validated cold authenticated dependency and private Orchestrator downloads with the merged action on the actual public QA runner.

Proof this works for Prod Edge downloads

Controlled production-aware pilot passed on the actual PHP QA runner. Application/test sources are this PR's final head 49f4ad124ede06e5e98ff7c896f4c05c1b9d811d. The disposable workflow pins the merged action 34a5cd54a008a57fb8e78ca41af265ab7cba66de, uses the same explicit private-reader input now in the PR, and adds only validation/logging scaffolding. Final PR references remain @v2: this proves the upcoming action behavior, not the current released v2 default.

Pilot: https://github.com/SonarSource/sonar-php/actions/runs/39536080602
Pilot definition: https://github.com/SonarSource/sonar-php/blob/50d30c97a61d027cf45f463cedc2adb58532c301/.github/workflows/build.yml

• Ran on the consumer's sonar-l-public label in the sonar-prod-public group, with fresh Gradle/Orchestrator homes and caching disabled.
• Fetched the production Vault private-reader and selected ARTIFACTORY_RESOLVE_URL=https://repox-internal.sonar.build/artifactory through the pinned action, without a repox-url override.
• Verified the role prerequisite: 2026-10-21T03:02:35.4730707Z PILOT metadata GET: public-reader=403 private-reader=404; private distribution HEAD=200. Required POM/JAR requests returned HTTP200.
• Observed the real Gradle test worker receiving -Dorchestrator.artifactory.url=https://repox-internal.sonar.build/artifactory from this PR's build.gradle.kts forwarding. Pilot scaffolding only supplies logging and private configuration; it does not set that JVM property.
• Resolved LATEST_RELEASE to 2026.5.2.132813 and downloaded the private Enterprise ZIP directly from production Edge: 2026-10-21T03:03:28.7607064Z 03:03:28.710 INFO c.s.orchestrator.locator.Artifactory - Found [com.sonarsource.sonarqube:sonarqube-enterprise-lw:2026.5.2.132813:zip] at https://repox-internal.sonar.build/artifactory/sonarsource/com/sonarsource/sonarqube/sonarqube-enterprise-lw/2026.5.2.132813/sonarqube-enterprise-lw-2026.5.2.132813.zip. The resulting fresh ZIP is 537,257,473 bytes.
• Completed existing plugin QA: 2026-10-21T03:06:04.9935924Z PILOT plugin QA reports: tests=28, failures=0, errors=0, skipped=0; reader token absent. The production reader token was absent from test reports.

Normal PR CI also passed on this final head with current @v2, including plugin/ruling/PR-analysis QA, Windows QA and promotion: https://github.com/SonarSource/sonar-php/actions/runs/39495404884 . Gitar passes with no unresolved review threads.

Scope: cold production dependency/private distribution downloads and 28 existing Linux plugin integration tests under LATEST_RELEASE. DEV, Windows and ruling suites were not production-piloted; their normal current-release CI passed. The earlier production pilot on sonar-prod/sonar-m is retained at https://github.com/SonarSource/sonar-php/actions/runs/39495623256 ; the later run above closes the actual-public-runner coverage gap. Pilots asserted the deployment endpoint remained SaaS, but did not deploy, promote or advance v2.

[hashicorp-vault-sonar-prod]

BUILD-13094

[bwalsh434]

[From Codex] Applied the Gitar suggestion: removed the unused Vault reader fetch from orchestrator-secrets. Also forwarded ARTIFACTORY_RESOLVE_URL to every subproject test JVM as orchestrator.artifactory.url, keeping Orchestrator runtime downloads aligned with the action-selected reader while preserving SaaS deployment. Real Gradle test-JVM probes passed with unset, SaaS and Prod Edge resolve endpoints.

[malte-skoruppa-sonarsource]

LGTM, with one small question below before we merge.

[malte-skoruppa-sonarsource]

LGTM!

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · Routing QA dependency and Orchestrator downloads through the private Repox reader could fail artifact resolution if the reader role and endpoint diverge.

Removes the explicit SaaS reader credential overrides from the three Orchestrator QA callers and forwards ARTIFACTORY_RESOLVE_URL to test JVMs as orchestrator.artifactory.url, keeping dependency and Orchestrator downloads on the Edge endpoint. The unused Artifactory reader token fetch from Vault has been resolved. No open issues found.

✅ 2 closed

✅ Quality: Unused Artifactory reader token still fetched from Vault

📄 .github/workflows/build.yml:162-168
This PR drops the ARTIFACTORY_ACCESS_TOKEN step env from all three QA build-gradle calls, so the reader exported by config-gradle through $GITHUB_ENV is the one used. The shared &orchestrator-secrets Vault step (reused via *orchestrator-secrets in qa_ruling and qa_pr_analysis) still requests development/artifactory/token/{REPO_OWNER_NAME_DASH}-public-reader ... | ARTIFACTORY_ACCESS_TOKEN. Nothing reads that value now. Each QA job still mints a SaaS reader token it never uses. Leaving it there also invites someone to wire it back in later, which would bring back the SaaS-vs-Edge credential mismatch this PR fixes. Remove the line so the step only fetches GITHUB_TOKEN.

Closed: Quality: QA reader role silently changes from public-reader to private-reader

📄 .github/workflows/build.yml:174 📄 .github/workflows/build.yml:221 📄 .github/workflows/build.yml:268
The commit deletes the {REPO_OWNER_NAME_DASH}-public-reader token override and adds artifactory-reader-role: private-reader to all three QA build-gradle calls. sonar-php is public, so without that input the action would pick public-reader (config-gradle role selection). The PR therefore doesn't just remove an override as the description says. It adds a new one with a wider scope. These jobs had passed with the public-reader credential, and nothing in the PR explains why they now need private-reader. Either drop the input so the visibility-based default applies (public-reader, same as before), or keep it and say in the description why the QA/Orchestrator downloads need the private role, then confirm that Vault grants private-reader to this public repo, including the job on the sonar-l-public runner.

Verification Rules 2/2 met PRs 1 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 1829: RC-461: Migrate sonar-php actual output location to build/actual/<projectKey>/ Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube