[hedinasr]

Part of BUILD-13564

Resolve NuGet, Maven and Orchestrator dependencies of CI and of the Chocolatey release download from the production JFrog Edge https://repox.sonar.build instead of SaaS Repox and the dev Edge. Staging and promotion stay on SaaS.

• CI actions: config-maven bumped from 2.3.0 to @v2 (2.5.1, which selects the artifactory-edge-prod Vault mount) with repox-url: https://repox.sonar.build; build-maven@v2 gets an explicit repox-url: https://repox.sonar.build.
• NuGet: the version-and-secrets action (Build, UTs Windows/Linux/macOS) and the Linux/macOS/Windows ITs now use config-nuget@v2 (private-reader, repox-url: https://repox.sonar.build). It rewrites the SaaS source of NuGet.Config to the Edge and exports ARTIFACTORY_USER / ARTIFACTORY_PASSWORD, which NuGet.Config and the IT projects (they copy it) consume. The committed NuGet.Config keeps the SaaS URL for local builds.
• Orchestrator: ORCHESTRATOR_ARTIFACTORY_URL moves to https://repox.sonar.build/artifactory on every OS, including GitHub-hosted macOS, which reaches the Edge through its public endpoint (the SaaS fallback for macOS is removed).
• Secrets: private-reader tokens previously read from development/artifactory are now provided by config-nuget from development/artifactory-edge-prod; the Chocolatey public-reader token moves to development/artifactory-edge-prod and uses its username field.
• Deployments: PublishChocolatey.yml downloads the released packages from https://repox.sonar.build/artifactory/sonarsource-public-releases.
• Permissions: unchanged. config-maven in the IT jobs reuses the build number claimed by the version job (read-only).

Out of scope:

• build-maven staging (ARTIFACTORY_DEPLOY_URL) and promote@v2 stay on SaaS https://repox.jfrog.io (writes).
• NuGet.Config, CONTRIBUTING.md, scripts/run-test-docker.ps1 / scripts/run-test-wsl.ps1 keep SaaS for local builds.
• its/projects/VueWithAspBackend/package-lock.json is an IT fixture that is never installed (ShouldRunNpmInstall=false).

Supersedes #3531

Test plan

• CI green on head: Build, UTs (Windows, Linux) and ITs (Windows, Linux) restore NuGet packages and resolve Maven/Orchestrator artifacts through repox.sonar.build
• macOS UTs/ITs green through repox.sonar.build (run on master, feature/* or workflow_dispatch)
• PublishChocolatey dry-run downloads both packages of a released version from repox.sonar.build

[hashicorp-vault-sonar-prod]

BUILD-13564

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Redirecting CI dependency resolution and Chocolatey downloads to the production JFrog Edge could disrupt builds or releases if credentials or artifacts differ.

Redirects CI, NuGet, Orchestrator, and Chocolatey dependency resolution from SaaS Repox and the dev Edge to the production JFrog Edge at https://repox.sonar.build, while staging and promotion stay on SaaS. No issues found.

Verification Rules 2/3 met PRs 2 inspected

Rules 1 failed 2 passed

❌ Approved GitHub Actions runners - its-windows.yml and ci.yml use warp-custom-dotnet-bubble-ci, which is not an approved label (use warp-custom-windows-2022-s/m/l/xl unless a specialist label is verified); policy: https://xtranet-sonarsource.atlassian.net/wiki/spaces/Platform/pages/3694231566/GitHub+Actions+Runners+-+GitHub
✅ Internal artifact registries
✅ Repository license compliance

Functional validation No results

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 373: BUILD-13373: Default self-hosted runners to repox.sonar.build Inspected
PR 3531: BUILD-13211: Use production Edge for NuGet restores Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud