From f107bfa97dcf769af2d06cdfbd8d0b5bc2b1267b Mon Sep 17 00:00:00 2001
From: Hedi Nasr <hedi.nasr@sonarsource.com>
Date: Thu, 17 Sep 2026 14:08:07 +0200
Subject: [PATCH 1/2] BUILD-12158: Stop selecting Vault from the Repox hostname

Mint Artifactory tokens from an explicit vault-url (default https://vault.sonar.build) so Edge resolve on *.dev.sonar.build does not hit vault.dev.
---
 build-maven/action.yml  | 6 +++++-
 config-maven/action.yml | 5 ++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/build-maven/action.yml b/build-maven/action.yml
index 56552881..514e062c 100644
--- a/build-maven/action.yml
+++ b/build-maven/action.yml
@@ -51,6 +51,9 @@ inputs:
   repox-url:
     description: URL for Repox
     default: https://repox.jfrog.io
+  vault-url:
+    description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
+    default: https://vault.sonar.build
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'
@@ -116,6 +119,7 @@ runs:
         artifactory-reader-role: ${{ inputs.artifactory-reader-role }}
         common-mvn-flags: ${{ inputs.common-mvn-flags }}
         repox-url: ${{ inputs.repox-url }}
+        vault-url: ${{ inputs.vault-url }}
         use-develocity: ${{ inputs.use-develocity }}
         develocity-url: ${{ inputs.develocity-url }}
         cache-paths: ${{ inputs.cache-paths }}
@@ -153,7 +157,7 @@ runs:
       if: inputs.deploy != 'false'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
+        url: ${{ inputs.vault-url }}
         # yamllint disable rule:line-length
         secrets: |
           ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_USERNAME_VAULT || '' }}
diff --git a/config-maven/action.yml b/config-maven/action.yml
index 7750f3b6..4547db04 100644
--- a/config-maven/action.yml
+++ b/config-maven/action.yml
@@ -15,6 +15,9 @@ inputs:
   repox-url:
     description: URL for Repox
     default: https://repox.jfrog.io
+  vault-url:
+    description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
+    default: https://vault.sonar.build
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'
@@ -95,7 +98,7 @@ runs:
       if: steps.config-maven-completed.outputs.skip != 'true'
       id: artifactory
       with:
-        url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
+        url: ${{ inputs.vault-url }}
         secrets: |
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
           development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;

From 7bc53f38732ae3693ab1c5933d089968d7bbf0f3 Mon Sep 17 00:00:00 2001
From: Hedi Nasr <hedi.nasr@sonarsource.com>
Date: Mon, 21 Sep 2026 15:23:45 +0200
Subject: [PATCH 2/2] BUILD-12158: Wait for Edge to accept the minted
 Artifactory token

Reuse wait-for-artifactory-token-federation so Maven does not resolve
against Edge until the Vault-issued token is federated.
---
 config-maven/action.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/config-maven/action.yml b/config-maven/action.yml
index 4547db04..957026bd 100644
--- a/config-maven/action.yml
+++ b/config-maven/action.yml
@@ -145,6 +145,15 @@ runs:
           echo "DEVELOCITY_ACCESS_KEY=${{ steps.develocity-hostname.outputs.hostname }}=$DEVELOCITY_TOKEN" >> "$GITHUB_ENV"
         fi
 
+    # Edge OIDC federation is eventually consistent. Skip SaaS (the default repox-url);
+    # Vault-minted tokens are usable there immediately.
+    - name: Wait for Artifactory token federation
+      if: steps.config-maven-completed.outputs.skip != 'true' && inputs.repox-url != 'https://repox.jfrog.io'
+      uses: SonarSource/sonarsource-infra-artifactory/.github/actions/wait-for-artifactory-token-federation@979fc5f122d4f67f0d7e0ea880e0f1c3b8019941
+      with:
+        artifactory-url: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        probe-path: 'api/search/versions?g=com.sonarsource.parent&a=parent&remote=1&repos=sonarsource-qa&v=*'
+
     - name: Configure Maven settings and set repository URL
       if: steps.config-maven-completed.outputs.skip != 'true'
       shell: bash