BUILD-13373: Default self-hosted runners to repox.sonar.build

README.md

@@ -73,18 +73,19 @@ These badges show the status of workflows in dummy repositories that use (or sho
 The `config-*` and `build-*` actions select the dependency resolve endpoint from `runner.environment` when `repox-url` is omitted:
 
 - GitHub-hosted runners use SaaS Repox (`https://repox.jfrog.io`).
-- Self-hosted runners use the production JFrog Edge (`https://repox-internal.sonar.build`).
+- Self-hosted runners use the production JFrog Edge (`https://repox.sonar.build`).
 - An explicit `repox-url` always overrides runner selection, including SaaS, dev Edge and production Edge URLs.
 
 The selected URL also determines the matching Vault server and reader-token engine.
 
 - Deployment, publication, build info and promotion always use SaaS Repox (`https://repox.jfrog.io`): the Edge is read-only.
-- The internal Edge hostname is only reachable from runners inside the SonarSource network.
-- Self-hosted runners without internal Edge connectivity must set `repox-url: https://repox.jfrog.io` on every affected `config-*`
-  and `build-*` action, including actions called through composite wrappers. GitHub-hosted runners with internal connectivity can
-  explicitly select `repox-url: https://repox-internal.sonar.build`.
+- `repox.sonar.build` resolves to the Edge's internal load balancer from the SonarSource runner networks and to its public load
+  balancer elsewhere, so the same URL works for runners, developer machines and committed lockfiles.
+- Self-hosted runners that must not use the Edge must set `repox-url: https://repox.jfrog.io` on every affected `config-*`
+  and `build-*` action, including actions called through composite wrappers. GitHub-hosted runners can explicitly select
+  `repox-url: https://repox.sonar.build`.
 - Repositories resolving through Edge during Orchestrator-based integration tests need an Orchestrator release that recognizes
-  `repox-internal.sonar.build` as a SonarSource Artifactory host. Until they adopt that release, set
+  `repox.sonar.build` as a SonarSource Artifactory host (6.4.4.4797 or later). Until they adopt that release, set
   `repox-url: https://repox.jfrog.io` to preserve authenticated private downloads and version alias resolution.
 - Match hardcoded package indexes and credentials to the selected `repox-url`. For example, update a named uv index and its
   lockfile when moving to the Edge, and avoid overwriting Edge credentials with independently fetched SaaS tokens.

build-gradle/action.yml

@@ -47,7 +47,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'

build-maven/action.yml

@@ -57,7 +57,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'

build-npm/action.yml

@@ -35,7 +35,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
     default: next

build-poetry/action.yml

@@ -33,7 +33,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
     default: next

build-yarn/action.yml

@@ -38,7 +38,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   sonar-platform:
     description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
     default: next

config-bun/action.yml

@@ -12,7 +12,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   disable-caching:
     description: Whether to disable Bun install caching entirely
     default: 'false'

config-gradle/action.yml

@@ -12,7 +12,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'

config-maven/action.yml

@@ -15,7 +15,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   use-develocity:
     description: Whether to use Develocity for build tracking.
     default: 'false'

config-npm/action.yml

@@ -18,7 +18,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   host-actions-root:
     description: Path to the actions folder on the host (used when called from another local action)
     default: ''

config-nuget/action.yml

@@ -15,7 +15,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
 
 runs:
   using: composite

config-pip/action.yml

@@ -13,7 +13,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   cache-paths:
     description: Cache paths to use (multiline).
     default: ~/.cache/pip

config-poetry/action.yml

@@ -15,7 +15,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   poetry-virtualenvs-path:
     description: Path to the Poetry virtual environments, relative to GitHub workspace. The folder is cached only if it is a subdirectory of
       `poetry-cache-dir`.

config-uv/action.yml

@@ -15,7 +15,7 @@ inputs:
   repox-url:
     description: URL for Repox used to resolve dependencies. Defaults to SaaS on GitHub-hosted runners and the production Edge
       on self-hosted runners. Explicit URLs override runner selection.
-    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox-internal.sonar.build' }}
+    default: ${{ runner.environment == 'github-hosted' && 'https://repox.jfrog.io' || 'https://repox.sonar.build' }}
   uv-cache-dir:
     description: Path to the uv cache directory, relative to GitHub workspace
     default: .cache/uv

spec/config-bun_spec.sh

@@ -3,11 +3,11 @@ eval "$(shellspec - -c) exit 1"
 
 export GITHUB_ENV=/dev/null
 export GITHUB_OUTPUT=/dev/null
-export ARTIFACTORY_URL="https://repox-internal.sonar.build/artifactory"
+export ARTIFACTORY_URL="https://repox.sonar.build/artifactory"
 export ARTIFACTORY_USERNAME="test-user"
 export ARTIFACTORY_ACCESS_TOKEN="test-token"
 
-EDGE_REGISTRY="https://repox-internal.sonar.build/artifactory/api/npm/npm/"
+EDGE_REGISTRY="https://repox.sonar.build/artifactory/api/npm/npm/"
 
 Describe 'config-bun/bun_config.sh'
   It 'does not run main when sourced'