BUILD-12158: Decouple Vault URL from Repox hostname

[hedinasr]

Summary

• Add vault-url to config-maven / build-maven (default https://vault.sonar.build).
• Stop deriving Vault from contains(repox-url, 'dev.sonar.build'), so Edge hostnames can resolve against Edge while minting SaaS tokens from prod Vault.
• Needed by the BUILD-12160 sonar-dummy probe; that PR pins build-maven@BUILD-12158.

Test plan

• sonar-dummy PR #648 Vault step uses url: https://vault.sonar.build (not vault.dev) and no longer 500s on SonarSource-sonar-dummy-private-reader.
• Existing callers that omit vault-url still mint from https://vault.sonar.build.
• Do not merge until the dummy probe has shown Maven get past Vault (next failure is expected to be missing Edge repos).

[hashicorp-vault-sonar-prod]

BUILD-12158

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

⚠️ Bug: Dropping dev-Vault derivation silently breaks dev/Edge Maven callers

Previously config-maven/build-maven auto-selected https://vault.dev.sonar.build whenever repox-url contained dev.sonar.build. With the new vault-url input defaulting unconditionally to https://vault.sonar.build, any existing caller that sets repox-url: https://repox.dev.sonar.build (and does not yet know about vault-url) now mints Artifactory tokens from prod Vault against the dev Repox, which fails auth at dependency-resolution/deploy time rather than at config time. The same workflow also becomes internally inconsistent: the ten sibling actions (config-npm, build-npm, config-gradle, build-gradle, config-pip, config-uv, config-poetry, build-poetry, build-yarn, promote) still derive Vault from repox-url, so e.g. build-maven + promote in one dev pipeline would hit two different Vaults. Keeping the derivation as the fallback when vault-url is not explicitly provided preserves current behavior while still allowing the Edge/prod split this PR needs.

Make vault-url an explicit override and keep the repox-url derivation as the default, in both build-maven and config-maven.:

  vault-url:
    description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
      Defaults to the Vault matching `repox-url` when not set.
    default: ''
# ...and at the vault-action-wrapper step:
        url: ${{ inputs.vault-url != '' && inputs.vault-url ||
          (contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build') }}

• Apply fix

_{Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎}

[gitar-bot]

💡 Quality: New vault-url input not documented in README input tables

vault-url is a new public input on both config-maven and build-maven, but the README input tables for those actions (which CONTRIBUTE.md requires to document each action's parameters) were not updated, so callers who need to point Maven at a different Vault have no discoverable documentation. Add a vault-url row to the config-maven table (after repox-url, line 259) and the build-maven table (after repox-url, line 364).

Add a vault-url row to both the config-maven and build-maven input tables in README.md.:

| `vault-url`               | Vault address used to mint Artifactory tokens. Independent of `repox-url`.  | `https://vault.sonar.build`                                          |

• Apply fix

_{Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎}

[gitar-bot]

Code Review ⚠️ Changes requested 0 closed / 2 findings

🟡 Medium risk

Decouples Vault URL from Repox hostname to allow Edge deployments to resolve against Edge while minting SaaS tokens from prod Vault. Dropping the dev-Vault auto-derivation silently breaks dev/Edge callers that set repox-url: https://repox.dev.sonar.build without the new vault-url input, and creates inconsistency with sibling actions still deriving Vault from repox-url. Keep the derivation as a fallback when vault-url is not provided. Additionally, document the new vault-url input in the README input tables for both config-maven and build-maven.

⚠️ Bug: Dropping dev-Vault derivation silently breaks dev/Edge Maven callers

📄 build-maven/action.yml:54-56 📄 build-maven/action.yml:160 📄 config-maven/action.yml:18-20 📄 config-maven/action.yml:101

Previously config-maven/build-maven auto-selected https://vault.dev.sonar.build whenever repox-url contained dev.sonar.build. With the new vault-url input defaulting unconditionally to https://vault.sonar.build, any existing caller that sets repox-url: https://repox.dev.sonar.build (and does not yet know about vault-url) now mints Artifactory tokens from prod Vault against the dev Repox, which fails auth at dependency-resolution/deploy time rather than at config time. The same workflow also becomes internally inconsistent: the ten sibling actions (config-npm, build-npm, config-gradle, build-gradle, config-pip, config-uv, config-poetry, build-poetry, build-yarn, promote) still derive Vault from repox-url, so e.g. build-maven + promote in one dev pipeline would hit two different Vaults. Keeping the derivation as the fallback when vault-url is not explicitly provided preserves current behavior while still allowing the Edge/prod split this PR needs.

Make `vault-url` an explicit override and keep the repox-url derivation as the default, in both build-maven and config-maven.

  vault-url:
    description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
      Defaults to the Vault matching `repox-url` when not set.
    default: ''
# ...and at the vault-action-wrapper step:
        url: ${{ inputs.vault-url != '' && inputs.vault-url ||
          (contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build') }}

💡 Quality: New vault-url input not documented in README input tables

📄 config-maven/action.yml:18-20 📄 build-maven/action.yml:54-56

vault-url is a new public input on both config-maven and build-maven, but the README input tables for those actions (which CONTRIBUTE.md requires to document each action's parameters) were not updated, so callers who need to point Maven at a different Vault have no discoverable documentation. Add a vault-url row to the config-maven table (after repox-url, line 259) and the build-maven table (after repox-url, line 364).

Add a vault-url row to both the config-maven and build-maven input tables in README.md.

| `vault-url`               | Vault address used to mint Artifactory tokens. Independent of `repox-url`.  | `https://vault.sonar.build`                                          |

🤖 Prompt for agents

Code Review: Decouples Vault URL from Repox hostname to allow Edge deployments to resolve against Edge while minting SaaS tokens from prod Vault. Dropping the dev-Vault auto-derivation silently breaks dev/Edge callers that set `repox-url: https://repox.dev.sonar.build` without the new `vault-url` input, and creates inconsistency with sibling actions still deriving Vault from `repox-url`. Keep the derivation as a fallback when `vault-url` is not provided. Additionally, document the new `vault-url` input in the README input tables for both `config-maven` and `build-maven`.

1. ⚠️ Bug: Dropping dev-Vault derivation silently breaks dev/Edge Maven callers
   Files: build-maven/action.yml:54-56, build-maven/action.yml:160, config-maven/action.yml:18-20, config-maven/action.yml:101

   Previously `config-maven`/`build-maven` auto-selected `https://vault.dev.sonar.build` whenever `repox-url` contained `dev.sonar.build`. With the new `vault-url` input defaulting unconditionally to `https://vault.sonar.build`, any existing caller that sets `repox-url: https://repox.dev.sonar.build` (and does not yet know about `vault-url`) now mints Artifactory tokens from prod Vault against the dev Repox, which fails auth at dependency-resolution/deploy time rather than at config time. The same workflow also becomes internally inconsistent: the ten sibling actions (`config-npm`, `build-npm`, `config-gradle`, `build-gradle`, `config-pip`, `config-uv`, `config-poetry`, `build-poetry`, `build-yarn`, `promote`) still derive Vault from `repox-url`, so e.g. `build-maven` + `promote` in one dev pipeline would hit two different Vaults. Keeping the derivation as the fallback when `vault-url` is not explicitly provided preserves current behavior while still allowing the Edge/prod split this PR needs.

   Fix (Make `vault-url` an explicit override and keep the repox-url derivation as the default, in both build-maven and config-maven.):
     vault-url:
       description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
         Defaults to the Vault matching `repox-url` when not set.
       default: ''
   # ...and at the vault-action-wrapper step:
           url: ${{ inputs.vault-url != '' && inputs.vault-url ||
             (contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build') }}

2. 💡 Quality: New vault-url input not documented in README input tables
   Files: config-maven/action.yml:18-20, build-maven/action.yml:54-56

   `vault-url` is a new public input on both `config-maven` and `build-maven`, but the README input tables for those actions (which CONTRIBUTE.md requires to document each action's parameters) were not updated, so callers who need to point Maven at a different Vault have no discoverable documentation. Add a `vault-url` row to the `config-maven` table (after `repox-url`, line 259) and the `build-maven` table (after `repox-url`, line 364).

   Fix (Add a vault-url row to both the config-maven and build-maven input tables in README.md.):
   | `vault-url`               | Vault address used to mint Artifactory tokens. Independent of `repox-url`.  | `https://vault.sonar.build`                                          |

Review coverage

Functional validation 0 of 4 objectives covered

Rules No rules evaluated

Auto-approval Not enabled · Set up

Implementation Status ◻️ 0 of 4 objectives covered

◻️ BUILD-12158 - 0 of 4 objectives covered

This PR covers the decoupling of the Vault URL from the Repox hostname by adding a vault-url input, while other objectives like Edge base URL configuration, feature-flagging, and documentation are not covered in this diff.

Other objectives on this issue, possibly covered elsewhere:

• ◻️ Update resolve config for Edge base URL
• ◻️ Keep deploy/promote URLs on repox.jfrog.io
• ◻️ Implement feature-flag or pilot allowlist before default cutover
• ◻️ Document the resolve versus deploy contract for product teams

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact	Unblock
gitar auto-apply:on	gitar display:verbose	gitar unblock

_{Was this helpful? React with 👍 / 👎 | Gitar}