BUILD-11521: Test build-npm with repox.dev.sonar.build

[julien-carsique-sonarsource]

Test PR for SonarSource/ci-github-actions#284

Uses repox-url: https://repox.dev.sonar.build on dev runners (group: sonar-dev) to verify that:

• Artifactory reader credentials come from vault.dev.sonar.build
• Artifactory deployer credentials come from vault.dev.sonar.build
• Sonar platform credentials still come from vault.sonar.build (prod)

Jobs testing with dev repox: build (NPM, deploy-pull-request=true) + custom-command (config-npm)

Jira: https://sonarsource.atlassian.net/browse/BUILD-11521

[gitar-bot]

CI failed: The build failed during the Sonar analysis step because npm encountered a 403 Forbidden error while attempting to fetch the @sonar/scan package from the configured Artifactory registry.

Overview

One build job failed because of authentication/authorization issues when fetching a scoped package (@sonar/scan) from the SonarSource Artifactory instance.

Failures

npm 403 Forbidden on @sonar/scan (confidence: high)

• Type: dependency
• Affected jobs: 79731743878
• Related to change: yes
• Root cause: The build environment is attempting to pull the @sonar/scan package from the registry defined in the custom configuration, but the provided ARTIFACTORY_ACCESS_TOKEN is denied access to this specific package or registry scope.
• Suggested fix: Verify that the ARTIFACTORY_ACCESS_TOKEN being injected into the environment has read permissions for the @sonar/scan package on the repox.dev.sonar.build registry. Ensure the .npmrc configuration correctly maps the @sonar scope to the intended Artifactory endpoint.

Summary

• Change-related failures: 1 (Build failed during dependency resolution for the custom registry configuration)
• Infrastructure/flaky failures: 0
• Recommended action: Review the Artifactory token permissions and ensure the npm configuration (likely managed by the build-npm action or local .npmrc) is correctly scoped to the new registry.

Code Review ✅ Approved

Integrates repox.dev.sonar.build into the CI workflow to validate Artifactory credential retrieval on development runners. No issues found.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}