PREQ-4933 Use plain poetry install to respect lock file

[tomverin]

Summary

• Replace jf poetry install with plain poetry install in the build-poetry action
• The JFrog CLI command internally runs poetry update, which ignores the lock file and re-resolves all dependencies — breaking builds when pyproject.toml constraints reference versions absent from the configured Repox indexes (e.g. syrupy 5.*)
• jf poetry-config is kept to configure the Repox registry; only the install step changes
• Retrieve ARTIFACTORY_USERNAME from Vault and export POETRY_HTTP_BASIC_REPOX_USERNAME / _PASSWORD so that plain poetry install can authenticate to Repox (credentials were previously handled internally by jf poetry install)

Context

• Ticket: PREQ-4933
• Root cause: jfrog-cli-artifactory poetry.go L302-L317 unconditionally calls poetry update after configuring the repo
• Failing run: https://github.com/SonarSource/sonarcloud-common-cdk-constructs/actions/runs/23643279945/job/68869068236
• Regression introduced by BUILD-10591 (JFrog CLI bump from 2.77.0 to 2.96.0)

Changes

build-poetry/build.sh

• jfrog_poetry_install(): replace jf poetry install --build-name --build-number with poetry install
• Export POETRY_HTTP_BASIC_REPOX_USERNAME and POETRY_HTTP_BASIC_REPOX_PASSWORD before install so Poetry can authenticate to the Repox source configured by jf poetry-config
• Add ARTIFACTORY_USERNAME to required env vars

build-poetry/action.yml

• Retrieve ARTIFACTORY_USERNAME from the same Vault path as ARTIFACTORY_ACCESS_TOKEN
• Pass ARTIFACTORY_USERNAME as env var to the build step

spec/build-poetry_spec.sh

• Add ARTIFACTORY_USERNAME to test env
• Update assertions to expect poetry install instead of jf poetry install

Trade-off

Dependency-level build info tracking in JFrog is lost (jf poetry install --build-name --build-number). The artifact upload, build-collect-env, and build-publish in the publish step still capture what matters for promotion and traceability.

Test plan

• All 28 shell spec tests pass locally
• Integration test via sonarcloud-common-cdk-constructs#350 — build is green
• SonarQube Quality Gate passed (100% coverage on new code)

[hashicorp-vault-sonar-prod]

PREQ-4933

[sonar-review-alpha]

Summary

This PR replaces jf poetry install (JFrog CLI) with plain poetry install to respect the lock file and avoid re-resolving all dependencies. The JFrog CLI command was internally calling poetry update, which broke builds when pyproject.toml constraints reference versions unavailable in the configured Repox indexes.

The fix keeps jf poetry-config to configure the Repox registry, but delegates installation to Poetry directly. Since Poetry no longer receives credentials through the JFrog CLI, we now explicitly pass ARTIFACTORY_USERNAME and ARTIFACTORY_ACCESS_TOKEN via POETRY_HTTP_BASIC_REPOX_* environment variables—Poetry's standard mechanism for remote authentication.

Changes:

• Retrieve ARTIFACTORY_USERNAME from Vault alongside the existing ARTIFACTORY_ACCESS_TOKEN
• Export credentials as env vars so plain poetry install can authenticate to Repox
• Drop jf poetry install --build-name/--build-number flags (loses dependency-level build info tracking in JFrog, but artifact uploads and build collection still capture what matters)

What reviewers should know

Focus areas for review:

1. Credential flow (action.yml, build.sh): Verify that ARTIFACTORY_USERNAME is correctly retrieved from Vault and passed through to the build step. Check that the POETRY_HTTP_BASIC_REPOX_* env vars follow Poetry's naming convention for remote authentication.

2. Lock file behavior: The core fix is that poetry install respects the lock file while jf poetry install (which wraps poetry update) does not. This should resolve the PREQ-4933 regression, but reviewers familiar with the affected downstream repo (sonarcloud-common-cdk-constructs#350) can confirm the green build.

3. JFrog config flow: jf poetry-config still runs to configure the Repox remote, then plain poetry install uses it. This is an important detail—the remote is still configured by JFrog, only the install step bypasses the JFrog CLI wrapper.

4. Test coverage: Tests expect poetry install now instead of the full JFrog command; the test additions confirm the new env var is in place.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[Copilot]

Pull request overview

Updates the build-poetry GitHub Action’s install step to use plain poetry install (while keeping jf poetry-config) so dependency installation respects poetry.lock and avoids unintended re-resolution caused by jf poetry install.

Changes:

• Replace jf poetry install with poetry install in the install function used by the action.
• Update shellspec expectations to match the new install command/output.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
build-poetry/build.sh	Switch dependency installation to poetry install after JFrog repo configuration to ensure lockfile is honored.
spec/build-poetry_spec.sh	Adjust shellspec assertions to expect poetry install and updated test description text.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

LGTM! ✅

Clean, minimal fix — the three changed files are tightly consistent and the credential plumbing is correct. Ready to merge.

🗣️ Give feedback