[bwalsh434]

BUILD-13211: Route internal/Warp Windows and Linux NuGet restores through https://repox.sonar.build with a fresh matching native private reader, using the shared config-nuget action pinned to b4eede988476ebb13a242fbc3ae4e8e374d78ad0. Hosted/macOS jobs keep SaaS access; local development keeps the committed SaaS configuration.

• Preserve generic Artifactory values around the shared action and scope the fresh reader to NuGetPackageSourceCredentials_Repox, compatible with Visual Studio 2017’s NuGet client. Keep existing Maven, Orchestrator, publication, signing and promotion credentials.
• Configure the existing Repox source before solution, tool, unit-test and integration-test download phases. Preserve required signatures, trusted signers, versions and lock hashes.
• Support paired SaaS rollback with NUGET_USE_PROD_EDGE=false, including Edge-to-SaaS calls in the same job. Normalize case/outer whitespace and reject invalid inherited values before Vault access.

Test plan and results for c0de48ab:

• Check source selection, repeated Edge/SaaS switches, configuration-byte invariants, generic credential restoration, failure cleanup, missing-native-credential failures and Bash/YAML syntax locally.
• Pass current-head Windows/Linux builds, unit/global-tool/packaging and all 12 Windows/3 Linux integration cases, including MSBuild 15, staging and PR promotion: https://github.com/SonarSource/sonar-scanner-msbuild/actions/runs/41119613202
• Pass the additional full current-head run including hosted macOS unit tests and all 3 macOS integration cases: https://github.com/SonarSource/sonar-scanner-msbuild/actions/runs/41119643055
• Pass Windows/Linux isolated-cache locked solution/tool restores, authenticated private metadata and complete signed private-package downloads through repox.sonar.build; repeat with separate SaaS caches/readers in the same job. All four legs preserve 77 lockfiles and all six generic Artifactory values. All 22 proof assertions pass: https://github.com/SonarSource/sonar-scanner-msbuild/actions/runs/41119736701
• Correlate production metadata and full-package downloads with the expected native reader, exact run user agent, client, UTC window, status and bytes. All four private-package transfers match at 71,091 bytes and SHA-256 264f1910956526a34abad6f6596ac4abcba79035636d77fd6d4db179e9a3a13f.
• Wait for successful Gitar re-review. No new code findings. Document the hostname migration in response to its outdated internal-registry rule; the prior rollback-variable thread remains automatically resolved.

Infrastructure dependency merged: https://github.com/SonarSource/sonarsource-infra-k8s/pull/186 . Temporary download-validation workflow/scripts stay outside this PR. Client caches are emptied for proof; production server caches remain enabled. Release-only NuGet signing/public publication are preserved and are not invoked. Post-merge bandwidth impact remains to be measured after adoption. This PR remains draft.

The explicit hostname overrides the shared action’s older repox-internal.sonar.build default. The merged infrastructure change publishes repox.sonar.build through split-horizon DNS: runner VPCs reach the production Edge’s internal ALB with the matching certificate. This is the reviewed hostname migration requested for this PR, supported by the authenticated Windows/Linux proof above.

• Linux: Complete private-package HTTP200 at 2026-10-30T20:00:42.524Z, trace ec392566f93f2fa14ddea170aebe0512; 373 correlated root package downloads. Private requests, root restores.
• Windows: Complete private-package HTTP200 at 2026-10-30T20:00:55.419Z, trace 93a4469c08bb52a6c0e75cd923c075e1; 367 correlated root package downloads. Private requests, root restores.

[hashicorp-vault-sonar-prod]

BUILD-13211

[datadog-sonarsource]

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c0de48a | Docs | Give us feedback!}

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Routing internal CI NuGet restores through production Edge with fresh private-reader credentials could disrupt builds if source selection or credential pairing is wrong.

Routes internal Windows and Linux NuGet restores through https://repox.sonar.build with a matching native private reader, using the shared config-nuget action pinned to a fixed revision. Rollback to SaaS via NUGET_USE_PROD_EDGE=false is preserved. The rollback variable now only honours exact lowercase false, addressing the open finding. No open issues remain.

✅ 1 closed

✅ Edge Case: Rollback variable only honours exact lowercase false

📄 .github/actions/configure-nuget/action.yml:20-29 📄 .github/actions/configure-nuget/README.md:7 📄 .github/actions/configure-nuget/README.md:15
When use-prod-edge is left empty, the selector checks "${NUGET_USE_PROD_EDGE:-}" != false as an exact string match. So False, FALSE, false or 0 in the repository/org Actions variable is quietly treated as "use production Edge". The README describes this variable as the CI rollback switch, and it says invalid values "fail before requesting credentials". That validation only covers the explicit input, though. A mistyped variable value does not stop the job and does not switch to SaaS: CI keeps using Edge during an incident while the operator thinks it has been rolled back. Fix: normalise the variable and reject anything other than empty/true/false, the same way the input is checked.

Verification Rules 1/3 met Knowledge ✅ 1 PRs 1 inspected

Rules 2 failed 1 passed

❌ Approved GitHub Actions runners - Windows/Linux jobs in its-windows.yml and ci.yml use specialist label warp-custom-dotnet-bubble-ci, which is not in the approved list and is unverified (pre-existing, not changed by this PR); other runners (sonar-xs/s, macos-latest-xlarge, github-ubuntu-latest-s) are approved. Verify the label's workload approval or migrate to warp-custom-windows-2022-s/m/l/xl; policy: https://xtranet-sonarsource.atlassian.net/wiki/spaces/Platform/pages/3694231566/GitHub+Actions+Runners+-+GitHub
❌ Internal artifact registries - NuGet restores go through the shared ci-github-actions config-nuget action to SaaS repox.jfrog.io (approved) or https://repox.sonar.build, which is not the documented production Edge host (repox-internal.sonar.build) and cannot be verified; confirm the endpoint or use the documented host.
✅ Repository license compliance

Functional validation No results

Knowledge ✅ 1 expectation met

NuGet rollback variable validation expectation met

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 373: BUILD-13373: Default self-hosted runners to repox.sonar.build Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[bwalsh434]

[From Codex] The registry-host verification refers to the previous internal hostname. This PR deliberately adopts repox.sonar.build following the merged split-horizon DNS and certificate change: https://github.com/SonarSource/sonarsource-infra-k8s/pull/186 . In the cluster and runner VPCs, the new hostname resolves to the production Edge’s internal ALB. The user explicitly requested this hostname migration.

Current-revision Windows/Linux proof passed all 22 assertions: https://github.com/SonarSource/sonar-scanner-msbuild/actions/runs/41119736701 . Authenticated private metadata and complete signed private-package downloads reached production Edge with its native private reader; SaaS rollback, all 77 lockfiles and unrelated Artifactory values were preserved. The PR description now records this reviewed hostname migration and Datadog request correlation. The former-host recommendation is therefore not applied.

[pavel-mikula-sonarsource]

The action looks like a candidate for reusable extraction

[pavel-mikula-sonarsource]

How much of this is reusable by the other 10 repos using NuGet? This looks like something that should live in one of the public tooling repos and be reused, instead of copied 10 times.

[hedinasr]

Superseded by #3537, which does the complete migration to repox.sonar.build.