CLP-1097 Migrate Orchestrator downloads to the JFrog Edge node for sonar-java

[guillaume-dequenne]

Part of CLP-918

Summary

• Route ruling and plugin QA Orchestrator downloads through JFrog Edge and wait for token federation in both jobs.
• Use the public shared action from PREQ-9016 Add public shared action for JFrog Edge token federation ci-github-actions#353; remove the repository-local copy.

Validation

• Workflow YAML parses and git diff --check passes.
• PR CI validates Edge reachability, token federation, and the integration tests.

Merge SonarSource/ci-github-actions#353 first, then repin this PR to a retained commit or release tag before merging it.

[hashicorp-vault-sonar-prod]

CLP-1097

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Ruling and plugin QA now fetch Orchestrator artifacts through authenticated JFrog Edge.

Migrates Orchestrator downloads to JFrog Edge with token federation for ruling and plugin QA jobs, addressing the probe curl timeout issue that could exceed the 2-minute bound. No open issues remain.

✅ 1 closed

✅ Edge Case: Probe curl has no timeout, so the 2-minute bound can be exceeded

📄 .github/actions/wait-for-artifactory-token-federation/action.yml:22-36
The retry loop assumes each attempt is fast: 12 × 10s sleeps, and the failure message says "within 2 minutes". The curl call sets no --connect-timeout or --max-time, though. curl's default connect timeout is 300s and it has no default overall limit, so a slow or unresponsive Edge node can hold one attempt for minutes or indefinitely. The ruling-qa and plugin-qa jobs then stall until the job timeout, and the 2-minute message doesn't match the real behaviour. The 000 retry branch is meant to handle an unreachable Edge, but it only runs after curl returns. Adding per-attempt timeouts fixes this.

Review coverage

🧪 Functional validation 1 of 1 objectives covered

📋 Rules No rules evaluated

🤖 Auto-approval Not enabled · Set up

Implementation Status ✅ 1 of 1 objectives covered

✅ CLP-918 - 1 of 1 objectives covered

This PR covers the migration of Orchestrator downloads to the JFrog Edge node by adding the artifactory token federation wait action and configuring the artifactory URL and access token properties.

✅ 1 covered here

• ✅ Migrate the Orchestrator's SonarQube download source to the JFrog Edge node

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube