PREQ-9016 Add public shared action for JFrog Edge token federation

[guillaume-dequenne]

Part of CLP-918

Why this action is needed

sonar-java #6257 is a concrete consumer: its public workflow cannot load the existing action from the private sonarsource-infra-artifactory repository. Putting the token federation wait in this public shared-actions repository removes the local helper copies from public migration PRs.

The action waits for a Vault-issued token to be accepted by JFrog Edge before an Orchestrator download. It retries temporary Edge responses, including 503, and documents the runner and token requirements.

Dependent PRs

• sonar-java #6257
• sonar-jacoco #316
• SonarJS #8062
• sonar-rust #401

Each currently pins the action commit from this branch and references this PR in its description. Merge this PR first; then repin the consumers to a retained commit or release tag before merging them. The private migration PRs use the existing shared private action and do not depend on this PR.

[hashicorp-vault-sonar-prod]

PREQ-9016

[gitar-bot]

Reviewing your code

Code Review 👍 Approved with suggestions 0 closed / 1 findings

🟡 Medium risk · Adds bounded token-readiness retries before artifact downloads, changing CI execution behavior.

Adds the wait-for-artifactory-token-federation action to handle temporary Edge failures before Orchestrator downloads, with comprehensive runner and token documentation. The README section order doesn't match the table of contents—move the new section to follow report-ci-metrics to align with the list ordering used throughout the document.

💡 Quality: README section order doesn't match the table of contents

📄 README.md:68-82

The new entry is added at the end of the "Actions provided in this repository" list, after report-ci-metrics. The ## wait-for-artifactory-token-federation section, however, sits right after that list and before ## get-build-number (line 89). Every other README section follows the list order, so a reader expecting this action last will find it first. To fix this, move the section (and its --- separator) to just after the report-ci-metrics section and before ## Deployment Strategy, or move the list entry to the top of the list.

🤖 Prompt for agents

Code Review: Adds the `wait-for-artifactory-token-federation` action to handle temporary Edge failures before Orchestrator downloads, with comprehensive runner and token documentation. The README section order doesn't match the table of contents—move the new section to follow `report-ci-metrics` to align with the list ordering used throughout the document.

1. 💡 Quality: README section order doesn't match the table of contents
   Files: README.md:68-82

   The new entry is added at the end of the "Actions provided in this repository" list, after `report-ci-metrics`. The `## wait-for-artifactory-token-federation` section, however, sits right after that list and before `## get-build-number` (line 89). Every other README section follows the list order, so a reader expecting this action last will find it first. To fix this, move the section (and its `---` separator) to just after the `report-ci-metrics` section and before `## Deployment Strategy`, or move the list entry to the top of the list.

Review coverage

🧪 Functional validation 1 of 1 objectives covered

📋 Rules No rules evaluated

Cross-repo coverage 12 repositories selected

🤖 Auto-approval Not enabled · Set up

Implementation Status ✅ 1 of 1 objectives covered

✅ CLP-918 - 1 of 1 objectives covered

This PR adds the wait-for-artifactory-token-federation action to support migrating Orchestrator downloads to the JFrog Edge node.

✅ 1 covered here

• ✅ Migrate the Orchestrator's SonarQube download source to the JFrog Edge node

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

💡 Quality: README section order doesn't match the table of contents

The new entry is added at the end of the "Actions provided in this repository" list, after report-ci-metrics. The ## wait-for-artifactory-token-federation section, however, sits right after that list and before ## get-build-number (line 89). Every other README section follows the list order, so a reader expecting this action last will find it first. To fix this, move the section (and its --- separator) to just after the report-ci-metrics section and before ## Deployment Strategy, or move the list entry to the top of the list.

_{Was this helpful? React with 👍 / 👎}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud