Skip to content

BUILD-12158: Decouple Vault URL from Repox hostname #350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
hedinasr wants to merge 1 commit into
base: master
Choose a base branch
from
+9 −2
Draft

BUILD-12158: Decouple Vault URL from Repox hostname #350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion build-maven/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,9 @@ inputs:
repox-url:
description: URL for Repox
default: https://repox.jfrog.io
vault-url:
description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
default: https://vault.sonar.build
Comment on lines +54 to +56

@gitar-bot gitar-bot Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: Dropping dev-Vault derivation silently breaks dev/Edge Maven callers

Previously config-maven/build-maven auto-selected https://vault.dev.sonar.build whenever repox-url contained dev.sonar.build. With the new vault-url input defaulting unconditionally to https://vault.sonar.build, any existing caller that sets repox-url: https://repox.dev.sonar.build (and does not yet know about vault-url) now mints Artifactory tokens from prod Vault against the dev Repox, which fails auth at dependency-resolution/deploy time rather than at config time. The same workflow also becomes internally inconsistent: the ten sibling actions (config-npm, build-npm, config-gradle, build-gradle, config-pip, config-uv, config-poetry, build-poetry, build-yarn, promote) still derive Vault from repox-url, so e.g. build-maven + promote in one dev pipeline would hit two different Vaults. Keeping the derivation as the fallback when vault-url is not explicitly provided preserves current behavior while still allowing the Edge/prod split this PR needs.

Make vault-url an explicit override and keep the repox-url derivation as the default, in both build-maven and config-maven.:

  vault-url:
    description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
      Defaults to the Vault matching `repox-url` when not set.
    default: ''
# ...and at the vault-action-wrapper step:
        url: ${{ inputs.vault-url != '' && inputs.vault-url ||
          (contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build') }}
  • Apply fix

Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎

use-develocity:
description: Whether to use Develocity for build tracking.
default: 'false'
Expand Down Expand Up @@ -116,6 +119,7 @@ runs:
artifactory-reader-role: ${{ inputs.artifactory-reader-role }}
common-mvn-flags: ${{ inputs.common-mvn-flags }}
repox-url: ${{ inputs.repox-url }}
vault-url: ${{ inputs.vault-url }}
use-develocity: ${{ inputs.use-develocity }}
develocity-url: ${{ inputs.develocity-url }}
cache-paths: ${{ inputs.cache-paths }}
Expand Down Expand Up @@ -153,7 +157,7 @@ runs:
if: inputs.deploy != 'false'
id: artifactory
with:
url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
url: ${{ inputs.vault-url }}
# yamllint disable rule:line-length
secrets: |
${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_USERNAME_VAULT || '' }}
Expand Down
5 changes: 4 additions & 1 deletion config-maven/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ inputs:
repox-url:
description: URL for Repox
default: https://repox.jfrog.io
vault-url:
description: Vault address used to mint Artifactory tokens. Independent of `repox-url`.
default: https://vault.sonar.build
Comment on lines +18 to +20

@gitar-bot gitar-bot Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Quality: New vault-url input not documented in README input tables

vault-url is a new public input on both config-maven and build-maven, but the README input tables for those actions (which CONTRIBUTE.md requires to document each action's parameters) were not updated, so callers who need to point Maven at a different Vault have no discoverable documentation. Add a vault-url row to the config-maven table (after repox-url, line 259) and the build-maven table (after repox-url, line 364).

Add a vault-url row to both the config-maven and build-maven input tables in README.md.:

| `vault-url`               | Vault address used to mint Artifactory tokens. Independent of `repox-url`.  | `https://vault.sonar.build`                                          |
  • Apply fix

Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎

use-develocity:
description: Whether to use Develocity for build tracking.
default: 'false'
Expand Down Expand Up @@ -95,7 +98,7 @@ runs:
if: steps.config-maven-completed.outputs.skip != 'true'
id: artifactory
with:
url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }}
url: ${{ inputs.vault-url }}
secrets: |
development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
Expand Down
Loading