BUILD-11961 Poll edge Artifactory until token returns HTTP 200

Replace the fixed 10s sleep with a shared retry loop against a
protected storage API so builds proceed as soon as federation syncs.

Author: hedinasr

config-maven/action.yml

@@ -145,13 +145,7 @@ runs:
       shell: bash
       env:
         REPOX_URL: ${{ inputs.repox-url }}
-      run: |
-        if [[ "$REPOX_URL" == *jfrog.io* ]]; then
-          echo "Skipping token sync wait for SaaS Repox ($REPOX_URL)"
-          exit 0
-        fi
-        echo "Waiting 10s for Artifactory token federation sync to the edge node"
-        sleep 10
+      run: "$(dirname "$ACTION_PATH_CONFIG_MAVEN")/shared/wait_artifactory_token_sync.sh"
 
     - name: Configure Maven settings and set repository URL
       if: steps.config-maven-completed.outputs.skip != 'true'

config-npm/action.yml

@@ -103,13 +103,10 @@ runs:
       shell: bash
       env:
         REPOX_URL: ${{ inputs.repox-url }}
-      run: |
-        if [[ "$REPOX_URL" == *jfrog.io* ]]; then
-          echo "Skipping token sync wait for SaaS Repox ($REPOX_URL)"
-          exit 0
-        fi
-        echo "Waiting 10s for Artifactory token federation sync to the edge node"
-        sleep 10
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_USERNAME: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USERNAME || '' }}
+        ARTIFACTORY_ACCESS_TOKEN: ${{ steps.secrets.outputs.vault && fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN || '' }}
+      run: "$(dirname "$ACTION_PATH_CONFIG_NPM")/shared/wait_artifactory_token_sync.sh"
 
     - name: Configure NPM authentication
       if: steps.config-npm-completed.outputs.skip != 'true'

config-uv/action.yml

@@ -116,13 +116,10 @@ runs:
       shell: bash
       env:
         REPOX_URL: ${{ inputs.repox-url }}
-      run: |
-        if [[ "$REPOX_URL" == *jfrog.io* ]]; then
-          echo "Skipping token sync wait for SaaS Repox ($REPOX_URL)"
-          exit 0
-        fi
-        echo "Waiting 10s for Artifactory token federation sync to the edge node"
-        sleep 10
+        ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }}
+        ARTIFACTORY_USERNAME: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USERNAME }}
+        ARTIFACTORY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
+      run: "$(dirname "$ACTION_PATH_CONFIG_UV")/shared/wait_artifactory_token_sync.sh"
 
     - name: Configure uv authentication
       if: steps.config-uv-completed.outputs.skip != 'true'

shared/wait_artifactory_token_sync.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# Wait until a SaaS-minted Artifactory token is accepted by an edge node.
+#
+# /api/system/ping is anonymous; use a protected storage API that validates the token.
+#
+# Required environment variables:
+# - ARTIFACTORY_URL: Artifactory base URL (…/artifactory)
+# - ARTIFACTORY_USERNAME: Artifactory username
+# - ARTIFACTORY_ACCESS_TOKEN: Artifactory access token
+#
+# Optional:
+# - REPOX_URL: Instance URL used to skip the wait for SaaS (jfrog.io)
+
+set -euo pipefail
+
+REPOX_URL="${REPOX_URL:-${ARTIFACTORY_URL:-}}"
+if [[ "$REPOX_URL" == *jfrog.io* ]]; then
+  echo "Skipping token sync wait for SaaS Repox ($REPOX_URL)"
+  exit 0
+fi
+
+if [[ -z "${ARTIFACTORY_URL:-}" || -z "${ARTIFACTORY_USERNAME:-}" || -z "${ARTIFACTORY_ACCESS_TOKEN:-}" ]]; then
+  echo "::error title=Missing Artifactory credentials::Cannot wait for token sync without credentials"
+  exit 1
+fi
+
+check_url="${ARTIFACTORY_URL%/}/api/storage/sonarsource-qa"
+max_attempts=60
+sleep_seconds=5
+attempt=0
+
+echo "Waiting for Artifactory token federation sync at $check_url (up to $((max_attempts * sleep_seconds))s)"
+
+while true; do
+  attempt=$((attempt + 1))
+  http_code="$(curl -sS -o /dev/null -w '%{http_code}' \
+    -u "${ARTIFACTORY_USERNAME}:${ARTIFACTORY_ACCESS_TOKEN}" \
+    "$check_url" || echo "000")"
+
+  if [[ "$http_code" == "200" ]]; then
+    echo "Artifactory accepted credentials after ${attempt} attempt(s) (HTTP 200)"
+    exit 0
+  fi
+
+  if (( attempt >= max_attempts )); then
+    echo "::error title=Artifactory token sync timeout::Credentials were not accepted by $check_url" \
+      "within $((max_attempts * sleep_seconds))s (last HTTP ${http_code})"
+    exit 1
+  fi
+
+  echo "Attempt ${attempt}/${max_attempts}: HTTP ${http_code}, retrying in ${sleep_seconds}s..."
+  sleep "$sleep_seconds"
+done