CLP-1097 Migrate Orchestrator downloads to the JFrog Edge node for sonar-java

[guillaume-dequenne]

Part of CLP-918

Summary

CI resolves Maven dependencies and Orchestrator downloads through the dev JFrog Edge (https://repox-internal.dev.sonar.build) with ci-github-actions 2.2.0. With an Edge repox-url, the reader token is issued by the Edge (development/artifactory-edge-dev on https://vault.dev.sonar.build), so there is no token federation wait.

• Every build-maven and config-maven step in build.yml and unified-dogfooding.yml is pinned to 2.2.0 and sets repox-url: https://repox-internal.dev.sonar.build. build-maven still deploys to https://repox.jfrog.io with the SaaS qa-deployer token, and promote stays on SaaS.
• Orchestrator 6.4.3 reads ARTIFACTORY_URL and ARTIFACTORY_ACCESS_TOKEN from config-maven, so the explicit -Dorchestrator.artifactory.* flags and the federation wait steps are removed.

Blocked

The Spring scanner ITs in Build and Unit Test on Windows fail with a 401. sonar-scanner-integration-tester 1.2.0.1354 is a shaded jar that bundles Orchestrator 6.2.0, which reads maven-metadata.xml from the Edge without a token. Its master is on Orchestrator 6.4.3 (#86) but unreleased; this PR needs that release and a bump of sonar-scanner-integration-tester.

Validation

• PR Build green on the current head, including Build and Unit Test on Windows and the Linux ruling jobs.

[hashicorp-vault-sonar-prod]

CLP-1097

[github-actions]

❌ Ruling needs updating. A fix PR has been created: #6290

Please review and merge it into your branch.

[gitar-bot]

Code Review ✅ Approved 3 closed / 3 findings

🟡 Medium risk · CI Maven and Orchestrator downloads now resolve through the internal JFrog Edge.

Migrates Orchestrator downloads to JFrog Edge with ci-github-actions 2.2.0, configuring repox-url across build workflows and pinning sonar-orchestrator-locators and sonar-orchestrator-build to 6.4.3.4676 in scanner integration tests. Addressed probe timeout and unified-dogfooding.yml Edge configuration; PR description updated to reflect the Edge-issued-token approach.

✅ 3 closed

✅ Edge Case: Probe curl has no timeout, so the 2-minute bound can be exceeded

📄 .github/actions/wait-for-artifactory-token-federation/action.yml:22-36
The retry loop assumes each attempt is fast: 12 × 10s sleeps, and the failure message says "within 2 minutes". The curl call sets no --connect-timeout or --max-time, though. curl's default connect timeout is 300s and it has no default overall limit, so a slow or unresponsive Edge node can hold one attempt for minutes or indefinitely. The ruling-qa and plugin-qa jobs then stall until the job timeout, and the 2-minute message doesn't match the real behaviour. The 000 retry branch is meant to handle an unreachable Edge, but it only runs after curl returns. Adding per-attempt timeouts fixes this.

✅ Quality: unified-dogfooding.yml still uses build-maven@v2 without the Edge repox-url

📄 .github/workflows/build.yml:37-42
This commit moves every Maven step in build.yml to ci-github-actions@c3a85ac… (v2.2.0) with repox-url: https://repox-internal.dev.sonar.build. .github/workflows/unified-dogfooding.yml:19 still uses the floating build-maven@v2 with the same private-reader/qa-deployer roles and no repox-url, so it keeps resolving through repox.jfrog.io. pr-cleanup.yml also stays on the floating @v2. Nothing in the repo shows this is deliberate. Either apply the same pin and repox-url there, or document why dogfooding should stay on the public Repox.

✅ Quality: PR description no longer matches the code: token-wait and #353 were dropped

📄 .github/workflows/build.yml:95-97 📄 .github/workflows/build.yml:109-123 📄 .github/workflows/build.yml:215-217 📄 .github/workflows/build.yml:229-237
The description says both jobs "wait for token federation", use the shared action from SonarSource/ci-github-actions#353, and that #353 must be merged and repinned before this PR merges. Commit dca4538 removed both wait-for-artifactory-token-federation steps and the explicit -Dorchestrator.artifactory.* flags. Orchestrator now reads ARTIFACTORY_URL/ARTIFACTORY_ACCESS_TOKEN from config-maven@v2.2.0 with repox-url set, and every ci-github-actions step is pinned to v2.2.0. Reviewers and mergers following the description would wait on an unrelated upstream PR, and they would expect a federation wait that the code no longer has. Update the summary, validation and merge-order notes to describe the Edge-issued-token approach.

Review coverage

🧪 Functional validation 1 of 1 objectives covered

📋 Rules No rules evaluated

🤖 Auto-approval Not enabled · Set up

Implementation Status ✅ 1 of 1 objectives covered

✅ CLP-918 - 1 of 1 objectives covered

This PR covers the migration of Orchestrator downloads to the JFrog Edge node.

✅ 1 covered here

• ✅ Migrate the Orchestrator's SonarQube download source to the JFrog Edge node

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube