SC-37240 Add config-pip action

[jduchon-sonarsource]

In most of InfraSec repositories, we use pip to install pipenv, and we want to make sure we pull it from JFrog Artifactory.

This action configures pip to use the internal instead of the public pypi registry.

Tested with: https://github.com/SonarSource/infra-aws-account-vending-service/actions/runs/19966951800/job/57266012611?pr=26#step:3:1085

[hashicorp-vault-sonar-prod]

SC-37240

[sonarqubecloud]

SonarQube reviewer guide

Important

We are currently testing different models for AI Summary.
Please give us your feedback by filling this form.

Model A:

Summary: Add config-pip action to configure pip with JFrog Artifactory authentication and caching.

Review Focus: The new shell script config-pip/config.sh handles credential injection into pip configuration - verify proper secret handling and URL parsing logic. Check that the action.yml correctly chains get-build-number and cache actions with appropriate input/output handling.

Start review at: config-pip/config.sh. This script constructs pip configuration with embedded credentials and must handle URL parsing correctly to avoid security issues or misconfigurations.

Model B:

Summary: Add config-pip GitHub Action for pip build environment configuration with Artifactory authentication, plus update actions/checkout to v5.0.0 across documentation and test configurations.

Review Focus:

• The new config-pip action implementation (action.yml, config.sh) and its integration with existing actions (get-build-number, cache, shared)
• Pip configuration script security (credentials handling in pip.conf)
• Test coverage completeness for the new action
• Consistency of actions/checkout version upgrades across all documentation examples

Start review at: config-pip/action.yml. This is the entry point for the new action and defines all inputs, outputs, and the orchestration of steps. Understanding the action composition here will help you validate the downstream script (config.sh) and test suite (spec/config-pip_spec.sh).

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud