BUILD-10591 Leverage setup-jfrog-cli summary in ci-github-actions

[julien-carsique-sonarsource]

Summary

Generate the JFrog CLI job summary explicitly rather than relying on the setup-jfrog-cli post-step, which fails and conflicts with the CLI.

Changes

build-maven, build-npm, build-yarn, build-poetry, config-npm, promote (scripts):

• Add --url flag to jf config add repox, otherwise the config is not working with all the CLI commands
• Add jf config use repox after jf config add to explicitly activate the server configuration

build-maven, build-npm, build-yarn, build-poetry (action.yml):

• Set JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR in the build step env so JFrog CLI writes command summary data during execution
• Enrich Generate workflow summary step with an extract from JFrog CLI summary

All build actions (workflow summary):

• Extract Published Modules from JFrog markdown.md: bold module names and multi-line <pre> file tree blocks, displayed in a collapsible <details> block
• Change build URL link text: Browse artifacts in Artifactory → Browse build name:number in Artifactory

promote/action.yml:

• Add repox-url and repox-artifactory-url inputs
• Add ARTIFACTORY_URL env var to the Promote artifacts step

Other:

• Upgrade renovatebot/pre-commit-hooks to 43.76.3 in .pre-commit-config.yaml (to support the managerFilePatterns field used in .github/renovate.json)
• Fix trailing spaces in deprecation warning messages (cache/action.yml, config-npm/action.yml, build-npm/action.yml, build-yarn/action.yml)
• Minor doc fixes in build-maven/build.sh and promote/promote.sh
• Update spec tests to match new command signatures and line counts (100% coverage)

Test plan

• https://github.com/SonarSource/sonar-dummy/pull/570 (Maven — no JFrog summary expected)
• test: BUILD-10591 dogfood feat/jcarsique/BUILD-10591-setup-jfrog-cli-summary sonar-dummy-gradle-oss#341 (Gradle — no JFrog summary expected)
• test: BUILD-10591 dogfood feat/jcarsique/BUILD-10591-setup-jfrog-cli-summary sonar-dummy-js#124 (NPM)
• test: BUILD-10591 dogfood feat/jcarsique/BUILD-10591-setup-jfrog-cli-summary sonar-dummy-python-oss#97 (Poetry)
• https://github.com/SonarSource/sonar-dummy-yarn/pull/50 (Yarn)
• Verify JFrog Job Summary appears in GitHub Actions workflow summary for NPM, Yarn, and Poetry builds
• Verify Generate JFrog CLI summary step does not fail when no artifacts were published (graceful || true)
• Verify no duplicate build-info publications
• Verify promote works end-to-end

[hashicorp-vault-sonar-prod]

BUILD-10591

[sonar-review-alpha]

Summary

This PR takes ownership of JFrog CLI summary generation in GitHub Actions workflows, moving from relying on the setup-jfrog-cli post-step (which was failing) to explicit configuration and summary extraction.

The core changes: (1) new shared/generate-jfrog-summary.sh script that extracts published modules and file trees from JFrog's markdown summary into a collapsible GitHub workflow details block, (2) all build action JFrog configs now include the base --url flag and explicit jf config use activation (required by newer CLI versions), and (3) promote action gains repox-url and repox-artifactory-url inputs to properly pass URLs to its steps. JFrog CLI upgraded from 2.77.0 → 2.96.0; all 100+ test assertions updated to match new command signatures.

What reviewers should know

Start with: the new shared/generate-jfrog-summary.sh script to understand the summary extraction logic — it uses sed/awk to parse JFrog's markdown output, extracting bold lines (module names) and multi-line <pre> blocks (file trees) into a GitHub details element.

Key pattern change: jf config add repox --artifactory-url $URL → jf config add repox --url $BASE_URL --artifactory-url $URL plus jf config use repox. The --url flag (without /artifactory) is required by JFrog CLI 2.96.0+ for all commands to work properly; jf config use explicitly activates the config. This pattern repeats across build-maven, build-npm, build-yarn, build-poetry, config-npm, and promote.

Integration point: Each build action's "Generate workflow summary" step now calls generate-jfrog-summary.sh repox (or deploy for Maven) after deployment, appending the parsed summary. This happens only if steps.build.outputs.deployed == true and the summary dir exists (graceful no-op if empty).

Promote inputs: New repox-url (default) and repox-artifactory-url (optional override) inputs let callers specify URLs; promote step uses them to set ARTIFACTORY_URL env var. Matches the pattern used by build actions.

Test coverage: All 100+ spec assertions were updated — watch for line number shifts and new assertions around jf config use calls. New spec file spec/shared_generate-jfrog-summary_spec.sh tests edge cases (missing summary dir, inline vs. multi-line <pre> blocks, etc.).

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

Conclusion: Solid PR overall — the fix is well-motivated, end-to-end tested, and the new JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR pattern is applied consistently. One logic duplication worth addressing before this pattern spreads further.

🗣️ Give feedback

[Copilot]

Pull request overview

This PR updates the CI GitHub Actions build/promote workflows to explicitly generate and enrich GitHub workflow summaries using JFrog CLI command summary output, while also updating JFrog CLI configuration to be more explicit/compatible.

Changes:

• Update JFrog CLI config usage across build/promote scripts (add --url, explicitly jf config use ..., bump JFrog CLI to 2.96.0).
• Enrich workflow summaries (build links + “Published Modules” extracted from JFrog-generated markdown.md) and wire JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR.
• Misc maintenance: spec updates, doc updates, pre-commit hook upgrade, and whitespace fixes in warnings.

Reviewed changes

Copilot reviewed 27 out of 29 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
config-npm/npm_config.sh	Update JFrog CLI server config to include --url and explicitly select the server.
build-npm/build.sh	Update JFrog CLI config for NPM publish flow (add --url, config use).
build-yarn/build.sh	Update JFrog CLI config for Yarn resolve/publish flows (add --url, config use).
build-poetry/build.sh	Update JFrog CLI config for Poetry resolve/publish flows (add --url, config use).
build-maven/deploy-artifacts.sh	Switch to jf CLI and add --url to deploy server config; use jf rt u.
build-npm/action.yml	Enable JFrog CLI command summary output + parse/publish “Published Modules” in workflow summary.
build-yarn/action.yml	Same: wire command summary output dir and enrich workflow summary.
build-poetry/action.yml	Same: wire command summary output dir and enrich workflow summary.
build-maven/action.yml	Wire command summary output dir for artifact upload + enrich workflow summary.
build-gradle/action.yml	Update summary link text/icon consistency.
promote/action.yml	Add Repox URL inputs and pass ARTIFACTORY_URL into promote step.
promote/promote.sh	Require ARTIFACTORY_URL, update JFrog config steps, tweak workflow summary link text.
mise.toml + */mise.local.toml	Bump jfrog-cli to 2.96.0 and set env exclusions / warning suppression.
README.md	Document new promote action inputs (repox-url, repox-artifactory-url).
.pre-commit-config.yaml	Bump renovate pre-commit hooks rev.
spec/*.sh	Update specs to match updated JFrog CLI commands/version and output line counts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[bwalsh434]

Overall LGTM and nice improvement! Copilot has lots of thoughts on the Artifactory URL construction, so make sure that works in varying scenarios/repos.

[sonar-review-alpha]

Conclusion: One concrete test bug found: the config-npm spec will fail due to a wrong expected --url value. The logic duplication from the previous review (the 16-line JFrog summary extraction block copied verbatim into all four action.yml files) remains unaddressed.

🗣️ Give feedback

[Copilot]

Pull request overview

This PR updates the CI GitHub Actions build/promotion workflows to explicitly generate and enrich the GitHub workflow summary using JFrog CLI command summaries, while also adjusting JFrog CLI server configuration to be more reliable across commands.

Changes:

• Introduces a shared script (shared/generate-jfrog-summary.sh) to generate JFrog CLI summary markdown and append a “Published Modules” section to GITHUB_STEP_SUMMARY.
• Updates build/promote scripts to configure JFrog CLI with --url and explicitly jf config use the configured server ID.
• Bumps JFrog CLI version to 2.96.0, updates workflow summary link text, and refreshes ShellSpec tests accordingly.

Reviewed changes

Copilot reviewed 29 out of 31 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
spec/shared_generate-jfrog-summary_spec.sh	Adds ShellSpec coverage for the new shared JFrog summary generator script.
spec/promote_spec.sh	Updates expected JFrog CLI config commands for promotion flow.
spec/config-npm_spec.sh	Updates expected JFrog CLI version and jf config add flags for npm config action tests.
spec/build-yarn_spec.sh	Adjusts expected output/line counts to reflect new jf config use behavior and CLI version.
spec/build-poetry_spec.sh	Updates expected output/line counts and JFrog CLI configuration behavior for Poetry builds.
spec/build-npm_spec.sh	Updates expected JFrog CLI version for npm builds.
spec/build-maven_deploy-artifacts_spec.sh	Updates mocks/expectations to use jf and new config flags for Maven artifact deployment.
shared/generate-jfrog-summary.sh	New script to generate/append JFrog “Published Modules” summary into GitHub step summary.
promote/promote.sh	Makes ARTIFACTORY_URL required and updates JFrog CLI config setup + summary link text.
promote/mise.local.toml	Bumps jfrog-cli version and adds JFrog CLI env hardening settings for local runs.
promote/action.yml	Adds Repox URL inputs and wires ARTIFACTORY_URL into the promote step environment.
mise.toml	Bumps jfrog-cli version and sets JFROG_CLI_ENV_EXCLUDE globally.
config-npm/npm_config.sh	Adds --url to jf config add derived from ARTIFACTORY_URL.
config-npm/mise.local.toml	Bumps jfrog-cli version and adds JFrog CLI env hardening settings.
config-npm/action.yml	Fixes trailing spaces in deprecation warning message formatting.
cache/action.yml	Fixes trailing spaces in deprecation warning message formatting.
build-yarn/mise.local.toml	Bumps jfrog-cli version and adds JFrog CLI env hardening settings.
build-yarn/build.sh	Updates JFrog CLI config to include --url and explicitly jf config use in publish flow.
build-yarn/action.yml	Sets JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR and appends JFrog summary info to workflow summary.
build-poetry/mise.local.toml	Bumps jfrog-cli version and adds JFrog CLI env hardening settings.
build-poetry/build.sh	Updates JFrog CLI config to include --url and explicitly jf config use for install/publish.
build-poetry/action.yml	Sets JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR and appends JFrog summary info to workflow summary.
build-npm/mise.local.toml	Bumps jfrog-cli version and adds JFrog CLI env hardening settings.
build-npm/build.sh	Updates JFrog CLI config to include --url and explicitly jf config use in publish flow.
build-npm/action.yml	Sets JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR and appends JFrog summary info to workflow summary.
build-maven/deploy-artifacts.sh	Switches to jf CLI and updates server config to include --url and ignore missing configs.
build-maven/build.sh	Minor doc wording adjustment for ARTIFACTORY_URL.
build-maven/action.yml	Sets JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR for deploy step and appends JFrog summary info.
build-gradle/action.yml	Adjusts workflow summary header and link text formatting.
README.md	Documents new promote action inputs (repox-url, repox-artifactory-url).
.pre-commit-config.yaml	Upgrades renovate pre-commit hook revision to support newer renovate config fields.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback

[sonarqubecloud]

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
5 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 29 out of 31 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.