BUILD-12645: Point CI Gradle resolve at Repox Edge

[tomverin]

Summary

• Point CI Gradle resolve at Edge https://repox-internal.dev.sonar.build/artifactory on self-hosted / WarpBuild only.
• Wait for token federation on sonarsource and plugins.gradle.org before Gradle (inlined wait: this public repo cannot resolve the private sonarsource-infra-artifactory action).
• Keep publish / promote on SaaS (artifactoryPublish context URL + promote@v1).
• Keep GitHub-hosted on SaaS (JetBrains Marketplace download is already hardcoded to repox.jfrog.io).
• Keep Orchestrator on SaaS: Edge returns HTTP 404 for api/search/versions on sonarsource-releases.
• Keep curl IDE tarball fetches on SaaS: Edge returns HTTP 404 for jetbrains-download (e.g. idea-2025.3.2.tar.gz). QA plugin zip still uses Edge.
• Local/off-VPN defaults stay on https://repox.jfrog.io.

Parent: BUILD-12645. This repo is ~1.7 TB/month on SaaS (Gradle 0.19 TB/week + curl 0.17 TB/week). The curl slice stays on SaaS until Edge serves jetbrains-download.

Test plan

• Self-hosted / WarpBuild Gradle resolve URLs are https://repox-internal.dev.sonar.build/artifactory/... (pluginManagement plugins.gradle.org + sonarsource)
• QA plugin zip fetch hits Edge (sonarsource-public-qa)
• QA IDE tarball curl stays on https://repox.jfrog.io/artifactory/jetbrains-download/...
• artifactoryPublish still deploys to SaaS https://repox.jfrog.io/artifactory (sonarsource-public-qa)
• Promote and JetBrains Marketplace download stay on SaaS
• Orchestrator still resolves SQ distributions from SaaS (orchestrator.artifactory.url=https://repox.jfrog.io/repox)
• After merge, Datadog artifactory.response.length.bytes for this repo’s Gradle client drops on SaaS (baseline ~0.19 TB/week). Curl IDEs (~0.17 TB/week) stay on SaaS until Edge has jetbrains-download.

[hashicorp-vault-sonar-prod]

BUILD-12645

[gitar-bot]

💡 Quality: Optional ARTIFACTORY_IDE_URL is listed under 'required'; header comment broken

The new ARTIFACTORY_IDE_URL is described as an optional override, but the header puts it under Environment variables (required):. An uncommented blank line (15) also splits the header comment block in two. Separately, line 41 now overwrites any ARTIFACTORY_URL the caller had exported. Anyone who used to point the script at a different Artifactory through ARTIFACTORY_URL gets SaaS with no warning, and the :? check on ARTIFACTORY_URL at line 43 can never fail. Move the variable into an optional section, remove the stray blank line, and drop the dead check.

Document the override as optional and keep the header comment in one block:

# Environment variables (required):
#   ARTIFACTORY_USERNAME:     Authentication username
#   ARTIFACTORY_ACCESS_TOKEN: Authentication token
#
# Environment variables (optional):
#   ARTIFACTORY_IDE_URL:      Override base URL; defaults to SaaS (Edge 404s jetbrains-download).
#

_{Was this helpful? React with 👍 / 👎}

[tomverin]

Closing to reopen as sonar-platform-bot (same branch).

[tomverin]

Reopened as sonar-platform-bot: #1896

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review 👍 Approved with suggestions 1 closed / 2 findings

🟡 Medium risk · Multiple CI workflows change artifact endpoints and token-federation behavior.

Redirects CI Gradle dependency resolution to Repox Edge on self-hosted/WarpBuild while keeping publish, GitHub-hosted, Orchestrator, and IDE tarball fetches on SaaS. Consider clarifying the ARTIFACTORY_IDE_URL as optional in the header comment (currently listed under required variables), removing the stray blank line that splits the comment block, and dropping the dead ARTIFACTORY_URL check that can never fail now that the variable is unconditionally overwritten.

💡 Quality: Optional ARTIFACTORY_IDE_URL is listed under 'required'; header comment broken

📄 .github/scripts/download-ides.sh:11-15 📄 .github/scripts/download-ides.sh:41-43

The new ARTIFACTORY_IDE_URL is described as an optional override, but the header puts it under Environment variables (required):. An uncommented blank line (15) also splits the header comment block in two. Separately, line 41 now overwrites any ARTIFACTORY_URL the caller had exported. Anyone who used to point the script at a different Artifactory through ARTIFACTORY_URL gets SaaS with no warning, and the :? check on ARTIFACTORY_URL at line 43 can never fail. Move the variable into an optional section, remove the stray blank line, and drop the dead check.

Document the override as optional and keep the header comment in one block

# Environment variables (required):
#   ARTIFACTORY_USERNAME:     Authentication username
#   ARTIFACTORY_ACCESS_TOKEN: Authentication token
#
# Environment variables (optional):
#   ARTIFACTORY_IDE_URL:      Override base URL; defaults to SaaS (Edge 404s jetbrains-download).
#

✅ 1 closed

Closed: Bug: Setting ARTIFACTORY_URL to Edge breaks build-gradle's SaaS build link

📄 .github/actions/point-resolve-at-edge/action.yml:10-11 📄 .github/workflows/build.yml:111-124 📄 .github/workflows/build.yml:677-689 📄 .github/scripts/download-ides.sh:40-41 📄 build.gradle.kts:214-217
point-resolve-at-edge overwrites ARTIFACTORY_URL with the Edge URL, not just ARTIFACTORY_RESOLVE_URL. build-gradle@1.8.8 reads that env var after a successful deploy to write the step-summary link (ARTIFACTORY_BROWSE_URL="${ARTIFACTORY_URL%/*}/ui/builds/$build_name/$BUILD_NUMBER"). The build-plugin job deploys build info to SaaS through the hardcoded setContextUrl in build.gradle.kts, but its summary link now points at https://repox-internal.dev.sonar.build/ui/builds/..., where that build info does not exist. The change also contradicts the PR's own comments, which say 'Publish/SaaS stays on ARTIFACTORY_URL' (download-ides.sh) and 'Local/off-VPN keeps ARTIFACTORY_URL' (settings.gradle.kts). Every resolve consumer already checks ARTIFACTORY_RESOLVE_URL first, so the fix is to export only ARTIFACTORY_RESOLVE_URL and leave ARTIFACTORY_URL on SaaS. The same applies to the 'Restore Edge resolve URL' step and the step-level env overrides in build.yml.

🤖 Prompt for agents

Code Review: Redirects CI Gradle dependency resolution to Repox Edge on self-hosted/WarpBuild while keeping publish, GitHub-hosted, Orchestrator, and IDE tarball fetches on SaaS. Consider clarifying the `ARTIFACTORY_IDE_URL` as optional in the header comment (currently listed under required variables), removing the stray blank line that splits the comment block, and dropping the dead `ARTIFACTORY_URL` check that can never fail now that the variable is unconditionally overwritten.

1. 💡 Quality: Optional ARTIFACTORY_IDE_URL is listed under 'required'; header comment broken
   Files: .github/scripts/download-ides.sh:11-15, .github/scripts/download-ides.sh:41-43

   The new `ARTIFACTORY_IDE_URL` is described as an optional override, but the header puts it under `Environment variables (required):`. An uncommented blank line (15) also splits the header comment block in two. Separately, line 41 now overwrites any `ARTIFACTORY_URL` the caller had exported. Anyone who used to point the script at a different Artifactory through `ARTIFACTORY_URL` gets SaaS with no warning, and the `:?` check on `ARTIFACTORY_URL` at line 43 can never fail. Move the variable into an optional section, remove the stray blank line, and drop the dead check.

   Fix (Document the override as optional and keep the header comment in one block):
   # Environment variables (required):
   #   ARTIFACTORY_USERNAME:     Authentication username
   #   ARTIFACTORY_ACCESS_TOKEN: Authentication token
   #
   # Environment variables (optional):
   #   ARTIFACTORY_IDE_URL:      Override base URL; defaults to SaaS (Edge 404s jetbrains-download).
   #

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}