BUILD-11500 Use self-hosted Artifactory for Maven actions

README.md

@@ -182,17 +182,20 @@ By default, Maven caches `~/.m2/repository`. You can customize this behavior:
 #### Required Vault Permissions
 
 - `public-reader` or `private-reader`: Artifactory role for reading dependencies.
+- `development/kv/data/develocity`: Develocity access token (only when `use-develocity: true`).
 
 #### Other Dependencies
 
 The Maven tool must be pre-installed. Use of `mise` is recommended.
 
+Dependencies are resolved from the self-hosted Artifactory instance at `https://repox-internal.dev.sonar.build/artifactory` (not configurable).
+
 ### Usage
 
 ```yaml
 permissions:
   id-token: write
-  contents: write
+  contents: read
 steps:
   - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
   - uses: SonarSource/ci-github-actions/config-maven@v1
@@ -216,7 +219,6 @@ steps:
 | `working-directory`       | Relative path under github.workspace to execute the build in                | `.`                                                                                                                     |
 | `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault                             | `private-reader` for private repos, `public-reader` for public repos                                                    |
 | `common-mvn-flags`        | Maven flags for all subsequent mvn calls                                    | `--batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false` |
-| `repox-url`               | URL for Repox                                                               | `https://repox.jfrog.io`                                                                                                |
 | `use-develocity`          | Whether to use Develocity for build tracking                                | `false`                                                                                                                 |
 | `develocity-url`          | URL for Develocity                                                          | `https://develocity.sonar.build/`                                                                                       |
 | `cache-paths`             | Custom cache paths (multiline).                                             | (optional)                                                                                                              |
@@ -238,13 +240,13 @@ steps:
 | `ARTIFACTORY_ACCESS_USERNAME` | Deprecated alias for `ARTIFACTORY_USERNAME`                                                                                                                                                                                               |
 | `ARTIFACTORY_USERNAME`        | Username for Artifactory authentication                                                                                                                                                                                                   |
 | `ARTIFACTORY_PASSWORD`        | Deprecated alias for `ARTIFACTORY_ACCESS_TOKEN`                                                                                                                                                                                           |
-| `ARTIFACTORY_URL`             | Artifactory (Repox) URL. E.x.: `https://repox.jfrog.io/artifactory`                                                                                                                                                                       |
+| `ARTIFACTORY_URL`             | Artifactory API base URL. E.g. `https://repox-internal.dev.sonar.build/artifactory`                                                                                                                                                            |
 | `BASH_ENV`                    | Path to the bash profile with mvn function for adding common flags to Maven calls                                                                                                                                                         |
 | `CURRENT_VERSION`             | The original project version from pom.xml                                                                                                                                                                                                 |
 | `DEVELOCITY_ACCESS_KEY`       | The Develocity access key when `use-develocity` is true                                                                                                                                                                                   |
 | `MAVEN_OPTS`                  | JVM options for Maven execution.                                                                                                                                                                                                          |
 | `PROJECT_VERSION`             | The project version with build number (after replacement)                                                                                                                                                                                 |
-| `SONARSOURCE_REPOSITORY_URL`  | URL for SonarSource Artifactory root virtual repository (i.e.: [`sonarsource`](https://repox.jfrog.io/artifactory/sonarsource) for release builds or [`sonarsource-qa`](https://repox.jfrog.io/artifactory/sonarsource-qa) for QA builds) |
+| `SONARSOURCE_REPOSITORY_URL`  | URL for SonarSource Artifactory root virtual repository (i.e.: [`sonarsource`](https://repox-internal.dev.sonar.build/artifactory/sonarsource) for release builds or [`sonarsource-qa`](https://repox-internal.dev.sonar.build/artifactory/sonarsource-qa) for QA builds) |
 | `CONFIG_MAVEN_COMPLETED`      | For internal use. If set, the action is skipped                                                                                                                                                                                           |
 | `MAVEN_CONFIG`                | Path to m2 root `$HOME/.m2`                                                                                                                                                                                                               |
 
@@ -321,7 +323,6 @@ See also [`config-maven`](#config-maven) input environment variables.
 | `deploy-pull-request`       | Whether to also deploy for pull requests. If deploy is false, this has no effect.                                            | `false`                                                                                     |
 | `maven-args`                | Additional arguments to pass to Maven                                                                                        | (optional)                                                                                  |
 | `scanner-java-opts`         | Additional Java options for the Sonar scanner (`SONAR_SCANNER_JAVA_OPTS`)                                                    | `-Xmx512m`                                                                                  |
-| `repox-url`                 | URL for Repox                                                                                                                | `https://repox.jfrog.io`                                                                    |
 | `use-develocity`            | Whether to use Develocity for build tracking                                                                                 | `false`                                                                                     |
 | `develocity-url`            | URL for Develocity                                                                                                           | `https://develocity.sonar.build/`                                                           |
 | `sonar-platform`            | SonarQube primary platform - 'next', 'sqc-eu', 'sqc-us', or 'none'. Use 'none' to skip sonar scans                           | `next`                                                                                      |
@@ -1415,7 +1416,6 @@ promote:
 
 | Input                     | Description                                                                                                               | Default                  |
 |---------------------------|---------------------------------------------------------------------------------------------------------------------------|--------------------------|
-| `repox-url`               | URL for Repox                                                                                                             | `https://repox.jfrog.io` |
 | `promote-pull-request`    | Whether to promote pull request artifacts. Requires `deploy-pull-request` input to be set to `true` in the build action   | `false`                  |
 | `multi-repo`              | If true, promotes to public and private repositories. For projects with both public and private artifacts                 | (optional)               |
 | `artifactory-deploy-repo` | Repository to deploy to. If not set, it will be retrieved from the build info                                             | (optional)               |

build-maven/action.yml

@@ -48,9 +48,6 @@ inputs:
   common-mvn-flags:
     description: Maven flags for all subsequent mvn calls
     default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
-  repox-url:
-    description: URL for Repox
-    default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'
@@ -113,7 +110,6 @@ runs:
         working-directory: ${{ inputs.working-directory }}
         artifactory-reader-role: ${{ inputs.artifactory-reader-role }}
         common-mvn-flags: ${{ inputs.common-mvn-flags }}
-        repox-url: ${{ inputs.repox-url }}
         use-develocity: ${{ inputs.use-develocity }}
         develocity-url: ${{ inputs.develocity-url }}
         cache-paths: ${{ inputs.cache-paths }}
@@ -151,16 +147,17 @@ runs:
       if: inputs.deploy != 'false'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
+        url: https://vault.sonar.build
         # yamllint disable rule:line-length
         secrets: |
           ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_USERNAME_VAULT || '' }}
           ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_ACCESS_TOKEN_VAULT || '' }}
           ${{ inputs.deploy != 'false' && inputs.mixed-privacy == 'true' && steps.params.outputs.ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN_VAULT || '' }}
-        # yamllint enable rule:line-length
+
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       id: secrets
       with:
+        url: https://vault.sonar.build
         # yamllint disable rule:line-length
         secrets: |
           ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }}

config-maven/action.yml

@@ -12,9 +12,6 @@ inputs:
   common-mvn-flags:
     description: Maven flags for all subsequent mvn calls
     default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
-  repox-url:
-    description: URL for Repox
-    default: https://repox.jfrog.io
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'
@@ -93,14 +90,15 @@ runs:
       if: steps.config-maven-completed.outputs.skip != 'true'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
+        url: https://vault.sonar.build
         secrets: |
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       if: steps.config-maven-completed.outputs.skip != 'true' && inputs.use-develocity == 'true'
       id: secrets
       with:
+        url: https://vault.sonar.build
         secrets: |
           development/kv/data/develocity token | DEVELOCITY_TOKEN;
 
@@ -116,7 +114,7 @@ runs:
       if: steps.config-maven-completed.outputs.skip != 'true'
       shell: bash
       env:
-        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_URL: https://repox-internal.dev.sonar.build/artifactory
         # yamllint disable rule:line-length
         ARTIFACTORY_USERNAME: ${{ steps.artifactory.outputs.vault && fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_USERNAME || '' }}
         ARTIFACTORY_ACCESS_TOKEN: ${{ steps.artifactory.outputs.vault && fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_ACCESS_TOKEN || '' }}
@@ -128,9 +126,14 @@ runs:
           echo "::warning title=Found invalid DEVELOCITY_ACCESS_KEY::DEVELOCITY_ACCESS_KEY should not be set manually" \
             "in the environment." >&2
           echo "[WARNING] DEVELOCITY_ACCESS_KEY is set in the environment with an empty token. This is a deprecated configuration." \
-          "The Develocity token is configured by config-maven. Please remove external configuration of DEVELOCITY_ACCESS_KEY."
+            "The Develocity token is configured by config-maven. Please remove external configuration of DEVELOCITY_ACCESS_KEY."
         fi
 
+        # Vault may return mixed-case usernames (e.g. vault-SonarSource-...), but JFrog Access
+        # token subjects are lowercase. Basic auth is case-sensitive on a federated edge node
+        # (DENIED LOGIN for vault-SonarSource-... while Bearer works as vault-sonarsource-...).
+        ARTIFACTORY_USERNAME="${ARTIFACTORY_USERNAME,,}"
+
         echo "ARTIFACTORY_URL=$ARTIFACTORY_URL" >> "$GITHUB_ENV"
         echo "ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME" >> "$GITHUB_ENV"
         echo "ARTIFACTORY_ACCESS_USERNAME=$ARTIFACTORY_USERNAME" >> "$GITHUB_ENV"  # deprecated, backward compliance

config-maven/resources/settings.xml

@@ -62,7 +62,7 @@
           <releases>
             <enabled>true</enabled>
             <!-- no need to always check if new versions are available when executing a Maven plugin without specifying the version -->
-            <updatePolicy>interval:60</updatePolicy>
+            <updatePolicy>always</updatePolicy>
             <checksumPolicy>fail</checksumPolicy>
           </releases>
           <snapshots>

promote/action.yml

@@ -2,9 +2,6 @@
 name: Promote
 description: GitHub Action to promote a project
 inputs:
-  repox-url:
-    description: URL for Repox
-    default: https://repox.jfrog.io
   promote-pull-request:
     description: Whether to promote pull request artifacts. Requires `deploy-pull-request` input to be set to `true` in the build action.
     default: 'false'
@@ -48,26 +45,21 @@ runs:
     - uses: ./.actions/get-build-number
       with:
         host-actions-root: ${{ steps.set-path.outputs.host_actions_root }}
-    - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
-      id: artifactory
-      with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
-        secrets: |
-          development/artifactory/token/{REPO_OWNER_NAME_DASH}-promoter access_token | ARTIFACTORY_PROMOTE_ACCESS_TOKEN;
     - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1
       id: secrets
       with:
+        url: https://vault.sonar.build
         secrets: |
-          development/github/token/{REPO_OWNER_NAME_DASH}-promotion token | GITHUB_TOKEN;
-    - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+          development/artifactory/token/{REPO_OWNER_NAME_DASH}-promoter access_token | ARTIFACTORY_PROMOTE_ACCESS_TOKEN;
+    - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
       with:
         version: 2026.6.14
     - name: Promote artifacts
       shell: bash
       env:
-        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
-        ARTIFACTORY_PROMOTE_ACCESS_TOKEN: ${{ fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_PROMOTE_ACCESS_TOKEN }}
-        GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
+        ARTIFACTORY_URL: https://repox-internal.dev.sonar.build/artifactory
+        ARTIFACTORY_PROMOTE_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PROMOTE_ACCESS_TOKEN }}
+        GITHUB_TOKEN: ${{ github.token }}
         DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         MULTI_REPO_PROMOTE: ${{ inputs.multi-repo }}
         ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo }}