BUILD-12996 Use DefaultArtifactory for the production JFrog Edge by hedinasr · Pull Request #439 · SonarSource/orchestrator

hedinasr · 2026-10-13T06:52:43Z

Summary

BUILD-12996: treat https://repox-internal.sonar.build (production JFrog Edge) as a SonarSource Artifactory host, like repox.jfrog.io and repox-internal.dev.sonar.build (#420).

Without it, ARTIFACTORY_URL=https://repox-internal.sonar.build/artifactory falls back to the unauthenticated MavenArtifactory, so private artifacts fail to download and version aliases (DEV, LATEST_RELEASE) don't resolve.

This must be released before ci-github-actions#359, which makes the production Edge the default repox-url and so the exported ARTIFACTORY_URL.

Test plan

ArtifactoryFactoryTest: the production Edge URL yields a DefaultArtifactory with the access token (new case); the dev Edge case is kept.
After promote, bump Orchestrator in a consumer repo and run its ITs against https://repox-internal.sonar.build.

gitar-bot · 2026-10-13T06:58:38Z

#438

  private static final List<String> SONARSOURCE_ARTIFACTORY_PREFIXES = List.of(
    DEFAULT_ARTIFACTORY_PREFIX,
+    "https://repox-internal.sonar.build",
    "https://repox-internal.dev.sonar.build"
  );


💡 [cross-pr] Duplicates and conflicts with orchestrator#438 for production Edge hosts · #438

This PR (head d615c1c) and #438 (head 972ad35) both start from base cd8ec73. Both add https://repox-internal.sonar.build to SONARSOURCE_ARTIFACTORY_PREFIXES and both rewrite the same Javadoc sentence in ArtifactoryFactory.java.

They add different entries, though. #438 also adds https://repox.sonar.build, plus ProductionEdgeTest and a CI workflow. The two also reshape ArtifactoryFactoryTest in incompatible ways:

Here, INTERNAL_REPOSITORY is repointed to the production host and a new INTERNAL_DEV_REPOSITORY is added.

In BUILD-12974: Support production Edge authentication #438, INTERNAL_REPOSITORY stays on the dev host, and BUILD-12974: Support production Edge authentication #438 adds @TempDir and changes getConfiguration.

Both use the same exact-host matching, so their behaviour does not contradict. But whichever PR merges second will hit textual conflicts in the list, Javadoc and test hunks and has to be reconciled by hand. If both are reconciled carelessly, the list can end up with duplicate entries, or the public host repox.sonar.build can be lost.

Condition: this depends on merge order. Separately, an Orchestrator release that recognizes the production Edge must be published, and consumers must bump to it, before SonarSource/ci-github-actions#359 (head 0716355e4fef7f3a00955905122f18e54bfb2452) is released. That PR exports ARTIFACTORY_URL=https://repox-internal.sonar.build/artifactory on self-hosted runners. Without the release, ITs silently fall back to the unauthenticated MavenArtifactory.

_{Was this helpful? React with 👍 / 👎}

Co-authored-by: Hedi Nasr <17797448+hedinasr@users.noreply.github.com>

gitar-bot · 2026-10-13T07:45:10Z

Code Review 👍 Approved with suggestions 1 closed / 2 findings

🟡 Medium risk · Classifying the production Edge as SonarSource Artifactory changes repository selection; incorrect matching could disrupt private artifact downloads and version-alias resolution.

Adds https://repox-internal.sonar.build (production JFrog Edge) to the SonarSource Artifactory host list so private artifacts download with the access token and version aliases resolve, with a new DefaultArtifactory test case. Approved with suggestions: this overlaps orchestrator#438 in ArtifactoryFactory.java and ArtifactoryFactoryTest.java, so whichever PR merges second will hit conflicts and needs careful reconciliation to avoid duplicate entries or losing repox.sonar.build. Also, an Orchestrator release with this change must be published and consumers bumped before ci-github-actions#359 is released, otherwise ITs silently fall back to the unauthenticated MavenArtifactory. Resolved: a locally committed Develocity workspace ID file was removed.

💡 [cross-pr] Duplicates and conflicts with orchestrator#438 for production Edge hosts · #438

📄 sonar-orchestrator-locators/src/main/java/com/sonar/orchestrator/locator/ArtifactoryFactory.java:37-41 📄 sonar-orchestrator-locators/src/main/java/com/sonar/orchestrator/locator/ArtifactoryFactory.java:49 📄 sonar-orchestrator-locators/src/test/java/com/sonar/orchestrator/locator/ArtifactoryFactoryTest.java:36-37 📄 sonar-orchestrator-locators/src/test/java/com/sonar/orchestrator/locator/ArtifactoryFactoryTest.java:69-70

This PR (head d615c1c) and #438 (head 972ad35) both start from base cd8ec73. Both add https://repox-internal.sonar.build to SONARSOURCE_ARTIFACTORY_PREFIXES and both rewrite the same Javadoc sentence in ArtifactoryFactory.java.

They add different entries, though. #438 also adds https://repox.sonar.build, plus ProductionEdgeTest and a CI workflow. The two also reshape ArtifactoryFactoryTest in incompatible ways:

Here, INTERNAL_REPOSITORY is repointed to the production host and a new INTERNAL_DEV_REPOSITORY is added.
In BUILD-12974: Support production Edge authentication #438, INTERNAL_REPOSITORY stays on the dev host, and BUILD-12974: Support production Edge authentication #438 adds @TempDir and changes getConfiguration.

Both use the same exact-host matching, so their behaviour does not contradict. But whichever PR merges second will hit textual conflicts in the list, Javadoc and test hunks and has to be reconciled by hand. If both are reconciled carelessly, the list can end up with duplicate entries, or the public host repox.sonar.build can be lost.

Condition: this depends on merge order. Separately, an Orchestrator release that recognizes the production Edge must be published, and consumers must bump to it, before SonarSource/ci-github-actions#359 (head 0716355e4fef7f3a00955905122f18e54bfb2452) is released. That PR exports ARTIFACTORY_URL=https://repox-internal.sonar.build/artifactory on self-hosted runners. Without the release, ITs silently fall back to the unauthenticated MavenArtifactory.

✅ 1 closed

✅ Quality: Local Develocity workspace ID file committed by accident

📄 .mvn/.develocity/develocity-workspace-id:1
The commit adds .mvn/.develocity/develocity-workspace-id. The Develocity Maven extension (configured in .mvn/extensions.xml/develocity.xml) creates this file on the machine that runs the build, and it holds a workspace ID unique to that checkout. It has nothing to do with the Artifactory change. If it's committed, every clone and CI run reports the same workspace ID, which mixes up build-scan workspace grouping, and other developers' builds will keep producing diffs to it. .gitignore does not ignore it today. Drop the file from the PR and add .mvn/.develocity/ to .gitignore.

🤖 Prompt for agents

Code Review: Adds `https://repox-internal.sonar.build` (production JFrog Edge) to the SonarSource Artifactory host list so private artifacts download with the access token and version aliases resolve, with a new `DefaultArtifactory` test case. Approved with suggestions: this overlaps orchestrator#438 in `ArtifactoryFactory.java` and `ArtifactoryFactoryTest.java`, so whichever PR merges second will hit conflicts and needs careful reconciliation to avoid duplicate entries or losing `repox.sonar.build`. Also, an Orchestrator release with this change must be published and consumers bumped before ci-github-actions#359 is released, otherwise ITs silently fall back to the unauthenticated `MavenArtifactory`. Resolved: a locally committed Develocity workspace ID file was removed.

1. 💡 [cross-pr] Duplicates and conflicts with orchestrator#438 for production Edge hosts · [#438](<https://github.com/SonarSource/orchestrator/pull/438>)
   Files: sonar-orchestrator-locators/src/main/java/com/sonar/orchestrator/locator/ArtifactoryFactory.java:37-41, sonar-orchestrator-locators/src/main/java/com/sonar/orchestrator/locator/ArtifactoryFactory.java:49, sonar-orchestrator-locators/src/test/java/com/sonar/orchestrator/locator/ArtifactoryFactoryTest.java:36-37, sonar-orchestrator-locators/src/test/java/com/sonar/orchestrator/locator/ArtifactoryFactoryTest.java:69-70

   This PR (head d615c1cf053035f89ce1f37812553da63a754b29) and https://github.com/SonarSource/orchestrator/pull/438 (head 972ad351a71a76c59ef3a14a32ecc0a82356e08c) both start from base cd8ec73. Both add `https://repox-internal.sonar.build` to `SONARSOURCE_ARTIFACTORY_PREFIXES` and both rewrite the same Javadoc sentence in `ArtifactoryFactory.java`.
   
   They add different entries, though. #438 also adds `https://repox.sonar.build`, plus `ProductionEdgeTest` and a CI workflow. The two also reshape `ArtifactoryFactoryTest` in incompatible ways:
   - Here, `INTERNAL_REPOSITORY` is repointed to the production host and a new `INTERNAL_DEV_REPOSITORY` is added.
   - In #438, `INTERNAL_REPOSITORY` stays on the dev host, and #438 adds `@TempDir` and changes `getConfiguration`.
   
   Both use the same exact-host matching, so their behaviour does not contradict. But whichever PR merges second will hit textual conflicts in the list, Javadoc and test hunks and has to be reconciled by hand. If both are reconciled carelessly, the list can end up with duplicate entries, or the public host `repox.sonar.build` can be lost.
   
   Condition: this depends on merge order. Separately, an Orchestrator release that recognizes the production Edge must be published, and consumers must bump to it, before https://github.com/SonarSource/ci-github-actions/pull/359 (head 0716355e4fef7f3a00955905122f18e54bfb2452) is released. That PR exports `ARTIFACTORY_URL=https://repox-internal.sonar.build/artifactory` on self-hosted runners. Without the release, ITs silently fall back to the unauthenticated `MavenArtifactory`.

Verification Repos 3 inspected

Functional validation No results

Rules No rules evaluated

Cross-repo 3 repositories inspected 0 open impacts

SonarSource/sonar-scanner-cli Inspected
SonarSource/sonar-lits Inspected
SonarSource/sonar-python Inspected

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

hedinasr · 2026-10-13T07:45:21Z

Closing as a duplicate of #438 (BUILD-12974).

sonarqube-next · 2026-10-13T08:02:03Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

BUILD-12996 Use DefaultArtifactory for the production JFrog Edge

d615c1c

gitar-bot Bot reviewed Oct 13, 2026

View reviewed changes

Comment thread .mvn/.develocity/develocity-workspace-id Outdated

gitar-bot Bot reviewed Oct 13, 2026

View reviewed changes

fix: ignore local Develocity workspace ID

89592d0

Co-authored-by: Hedi Nasr <17797448+hedinasr@users.noreply.github.com>

hedinasr closed this Oct 13, 2026

hedinasr deleted the feat/hnasr/BUILD-12996-prodEdge branch October 13, 2026 07:45

Navigation Menu

Repository navigation

BUILD-12996 Use DefaultArtifactory for the production JFrog Edge - #439

BUILD-12996 Use DefaultArtifactory for the production JFrog Edge#439
hedinasr wants to merge 2 commits into
masterfrom
feat/hnasr/BUILD-12996-prodEdge

hedinasr commented Oct 13, 2026 •

edited by atlassian Bot

Loading

Uh oh!

Uh oh!

gitar-bot Bot Oct 13, 2026

Uh oh!

gitar-bot Bot commented Oct 13, 2026

Uh oh!

hedinasr commented Oct 13, 2026

Uh oh!

sonarqube-next Bot commented Oct 13, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hedinasr commented Oct 13, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Uh oh!

gitar-bot Bot Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

gitar-bot Bot commented Oct 13, 2026

Uh oh!

hedinasr commented Oct 13, 2026

Uh oh!

sonarqube-next Bot commented Oct 13, 2026

Quality Gate passed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hedinasr commented Oct 13, 2026 •

edited by atlassian Bot

Loading