[hedinasr]

BUILD-13373

Self-hosted runners now default to https://repox.sonar.build instead of https://repox-internal.sonar.build in every config-* and build-* action. GitHub-hosted runners keep https://repox.jfrog.io.

Since sonarsource-infra-k8s#186, repox.sonar.build has split-horizon DNS: a private Route 53 zone attached to the engxp-k8s-prod, github-runners-prod and warpbuild-prod VPCs resolves it to the Edge's internal ALB, which serves the repox.sonar.build certificate. Runners in those VPCs take the same internal path as before. Elsewhere it resolves to the public ALB, so one URL works for runners, developer machines and committed lockfiles such as uv.lock.

• Vault token selection is unchanged: any URL that isn't jfrog.io or .dev.sonar.build uses artifactory-edge-prod.
• Orchestrator recognizes repox.sonar.build as a SonarSource Artifactory host from 6.4.4.4797, the same release that added repox-internal.sonar.build.
• An explicit repox-url still overrides the default, so https://repox-internal.sonar.build keeps working.

Test plan

Proof: internal route.

• From the internal network, repox.sonar.build resolves to the internal ALB and /artifactory/api/system/ping returns HTTP 200 with a valid certificate
• A consumer workflow on github-runners-prod or warpbuild-prod, pinned to this branch, resolves dependencies through https://repox.sonar.build
• From a GitHub-hosted runner with repox-url: https://repox.sonar.build, resolution goes through the public ALB

[hashicorp-vault-sonar-prod]

BUILD-13373

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Changing defaults across 13 dependency actions to repox.sonar.build could route package resolution through a different ALB and disrupt builds if DNS or access differs.

Defaults self-hosted runner Artifactory URL to https://repox.sonar.build across all config-* and build-* actions, while GitHub-hosted runners keep https://repox.jfrog.io. No issues found.

Verification Rules 2/2 met Knowledge ✅ 1 PRs 1 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Knowledge ✅ 1 expectation met

https://repox-internal.sonar.build (production JFrog Edge hostname): dependency with SonarSource/orchestrator expectation met

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 317: BUILD-11784 Route the Gradle buildscript classpath through Repox in config-gradle Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[hedinasr]

Internal route for repox.sonar.build

From the SonarSource internal network, repox.sonar.build resolves to the Edge's internal ALB and serves a valid certificate:

$ dig +short repox.sonar.build
repox-internal.sonar.build.
10.72.25.27
10.72.24.45
10.72.26.232

$ curl -s -o /dev/null -w 'HTTP %{http_code} ip=%{remote_ip} cert_verify=%{ssl_verify_result}\n' https://repox.sonar.build/artifactory/api/system/ping
HTTP 200 ip=10.72.24.45 cert_verify=0

Inside the engxp-k8s-prod, github-runners-prod and warpbuild-prod VPCs, the private Route 53 zone repox.sonar.build (Z10234042KBONFGSQRQIZ) holds A/AAAA aliases to the same internal ALB (internal-k8s-artifactoryprivat-876597782b-1627851268), whose HTTPS listener has both the repox.sonar.build and repox-internal.sonar.build certificates. The public ALB (k8s-artifactorypublic-9e702941d0) accepts 80/443 from 0.0.0.0/0.