Update GitHub actions by renovate[bot] · Pull Request #192 · SonarSource/ci-github-actions

renovate · 2025-12-19T13:44:36Z

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/gh-action_pre-commit	action	minor	`1.1.0` → `1.2.0`
SonarSource/vault-action-wrapper	action	patch	`3.1.0` → `3.1.1`
actions/attest-build-provenance	action	minor	`v3.0.0` → `v3.2.0`
actions/checkout	action	patch	`v5.0.0` → `v5.0.1`
digicert/ssm-code-signing	action	minor	`v1.1.1` → `v1.2.1`
jdx/mise-action	action	minor	`v3.5.1` → `v3.6.1`

Release Notes

SonarSource/gh-action_pre-commit (SonarSource/gh-action_pre-commit)

`v1.2.0`

Compare Source

What's Changed

BUILD-8875: Migrate to standardized GitHub runner names by @SonarTech in #39
chore(deps): update github actions by @renovate[bot] in #35
chore(deps): update github actions (major) by @renovate[bot] in #38
chore(deps): update dependency python to 3.14 by @renovate[bot] in #40
chore(deps): update actions/checkout action to v6 by @renovate[bot] in #42
chore(deps): update actions/cache action to v5 by @renovate[bot] in #44
chore(deps): update github actions by @renovate[bot] in #41

New Contributors

@SonarTech made their first contribution in #39

Full Changelog: SonarSource/gh-action_pre-commit@1.1.0...1.2.0

SonarSource/vault-action-wrapper (SonarSource/vault-action-wrapper)

`v3.1.1`

Compare Source

What's Changed

BUILD-8875: Migrate to standardized GitHub runner names by @SonarTech in #63
chore(deps): update actions/checkout action to v5 by @renovate[bot] in #62
chore(deps): update github actions by @renovate[bot] in #60
PREQ-3809 Add jwtTtl parameter to control GitHub OIDC token lifetime by @SamirM-BE in #68
PREQ-3809 Update jwtTtl default to 1h and replace RE team references by @SamirM-BE in #69

New Contributors

@SonarTech made their first contribution in #63

Full Changelog: SonarSource/vault-action-wrapper@3.1.0...3.1.1

actions/attest-build-provenance (actions/attest-build-provenance)

`v3.2.0`

Compare Source

What's Changed

Bump @actions/core from 1.11.1 to 2.0.1 by @dependabot[bot] in #776
Add more documentation on Artifact Metadata Storage Records by @malancas in #797
Update actions/attest to latest version v3.2.0 by @malancas in #812

Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0

`v3.1.0`

Compare Source

What's Changed

Prepare v3 release by @bdehamer in #697
Bump js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in #749
Bump tar from 7.5.1 to 7.5.2 by @dependabot[bot] in #753
Bump glob from 10.4.5 to 10.5.0 by @dependabot[bot] in #754
Bump @types/node from 24.10.1 to 25.0.2 by @dependabot[bot] in #774
Bump @actions/attest from 1.6.0 to 2.0.0 by @dependabot[bot] in #736
Bump @actions/attest from 2.0.0 to 2.1.0 by @dependabot[bot] in #775
Add support for creating artifact metadata storage records by @malancas in #779

New Contributors

@malancas made their first contribution in #779

Full Changelog: actions/attest-build-provenance@v3...v3.1.0

actions/checkout (actions/checkout)

`v5.0.1`

Compare Source

What's Changed

Port v6 cleanup to v5 by @ericsciple in #2301

Full Changelog: actions/checkout@v5...v5.0.1

digicert/ssm-code-signing (digicert/ssm-code-signing)

`v1.2.1`

Compare Source

[v1.2.1] – Security: Dependency upgrades and lifecycle date extension

Description
This release focuses on security hardening by upgrading direct and transitive dependencies to their latest secure versions. It also extends the end of service and end of life dates to allow customers additional time to migrate to DigiCert Binary Signing. These updates resolve multiple critical and high severity vulnerabilities while maintaining full backward compatibility.

Upgrade steps

Update your workflows to replace your uses value with:
uses: digicert/[email protected]

Breaking changes

None

New features

None

Bug fixes

Fixed multiple security vulnerabilities by updating dependencies to secure versions
Resolved known vulnerabilities in transitive dependencies used by the GitHub Action

Performance improvements

None

Other changes

Extended the end of service and end of life dates to allow for migration to DigiCert Binary Signing
Updated @digicert/ssm-client-tools-installer from v1.6.0 to v1.6.1
- Includes critical security patches and dependency updates
Upgraded security sensitive dependencies, including:
- semantic-release from 19.x to 25.x
- @semantic-release/github from 8.x to 12.x
- Multiple @octokit packages updated to the latest secure versions
Additional dependency updates to improve overall security posture

`v1.2.0`

Compare Source

[v1.2.0] - Improvement: Faster and more reliable tool downloads

Description
Updates the download source for ssm-client-tools-installer to use DigiCert’s CDN, resulting in faster and more reliable downloads of required tools during workflow execution.

Upgrade steps

Recommended: Migrate to DigiCert Binary Signing, as Code signing with Software Trust Manager is planned for deprecation on May 1, 2026.
Alternatively, update your workflow:
From:
uses: digicert/[email protected]
To:
uses: digicert/[email protected]

Breaking changes

None

New features

None

Bug fixes

None

Performance improvements

Improved reliability and consistency when downloading signing tools.

Other changes

Updated dependencies to fetch tools from DigiCert’s CDN.

jdx/mise-action (jdx/mise-action)

`v3.6.1`

Compare Source

What's Changed

Revert "fix(cache): isolate cache keys per working_directory in monorepos" by @jdx in #364
chore: release v3.6.1 by @mise-en-dev in #365

Full Changelog: jdx/mise-action@v3.6.0...v3.6.1

`v3.6.0`

Compare Source

What's Changed

chore(deps): update dependency prettier to v3.7.1 by @renovate[bot] in #331
chore(deps): update github/codeql-action digest to 497990d by @renovate[bot] in #324
chore(deps): update dependency typescript-eslint to v8.48.1 by @renovate[bot] in #332
chore(deps): update dependency @types/handlebars to v4.1.0 by @renovate[bot] in #314
chore(deps): update dependency @eslint/eslintrc to v3.3.3 by @renovate[bot] in #333
chore(deps): lock file maintenance by @renovate[bot] in #336
chore(deps): lock file maintenance by @renovate[bot] in #338
fix: use mise_dir input when specified by @jdx in #339
feat: add option to disable shims in PATH by @jdx in #340
fix: pass environment variables to mise commands by @jdx in #341
chore(deps): lock file maintenance by @renovate[bot] in #344
chore(deps): update github/codeql-action digest to 45c3735 by @renovate[bot] in #346
chore(deps): lock file maintenance by @renovate[bot] in #348
chore(deps): update actions/checkout action to v6 by @renovate[bot] in #350
chore(deps): lock file maintenance by @renovate[bot] in #352
docs: fix description for mise_toml input by @quad in #351
fix: make mise self-update output visible in logs by @nikobockerman in #355
chore(deps): update actions/setup-node action to v6 by @renovate[bot] in #356
chore(deps): lock file maintenance by @renovate[bot] in #358
chore(deps): update actions/setup-node digest to 6044e13 by @renovate[bot] in #361
fix(cache): isolate cache keys per working_directory in monorepos by @chadxz in #360
chore(deps): update github/codeql-action digest to 4bdb89f by @renovate[bot] in #362
chore(deps): update dependency @types/handlebars to v4.1.0 by @renovate[bot] in #349
chore(deps): update actions/upload-artifact action to v6 by @renovate[bot] in #357
chore: release v3.6.0 by @mise-en-dev in #342

New Contributors

@quad made their first contribution in #351
@nikobockerman made their first contribution in #355
@chadxz made their first contribution in #360

Full Changelog: jdx/mise-action@v3.5.1...v3.6.0

Configuration

📅 Schedule: Branch creation - "after 7am every weekday,before 8pm every weekday" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

hashicorp-vault-sonar-prod · 2025-12-19T13:45:35Z

Renovate Jira issue ID: BUILD-10012

sonarqubecloud · 2026-01-08T09:50:12Z

See all code changes, issues, and quality metrics in one place.

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2026-02-09T08:50:38Z

SonarQube reviewer guide

Summary: Update GitHub Actions and third-party dependencies to latest patch/minor versions across CI/CD workflows and build configurations.

Review Focus: Verify compatibility of the upgraded actions, particularly vault-action-wrapper (3.1.0 → 3.1.1), attest-build-provenance (3.0.0 → 3.2.0), mise-action (3.5.1 → 3.6.1), and digicert/ssm-code-signing (1.1.1 → 1.2.1). Check release notes for breaking changes and ensure no authentication or build provenance logic is affected by these updates.

Start review at: build-gradle/action.yml, build-maven/action.yml, build-npm/action.yml. These are critical build configurations that use multiple updated dependencies and handle artifact provenance attestation, making them the highest-risk files to validate first.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

renovate bot added the dependencies label Dec 19, 2025

renovate bot requested a review from a team as a code owner December 19, 2025 13:44

renovate bot force-pushed the renovate/github-actions branch from 8f5b1e1 to ca1e8ca Compare January 8, 2026 09:48

Update GitHub actions

b29d4a0

renovate bot force-pushed the renovate/github-actions branch from ca1e8ca to b29d4a0 Compare February 9, 2026 08:48

renovate bot changed the title ~~Roll back GitHub actions~~ Update GitHub actions Feb 9, 2026

jayadeep-km-sonarsource approved these changes Feb 9, 2026

View reviewed changes

jayadeep-km-sonarsource merged commit 7b3ebd0 into master Feb 9, 2026
12 checks passed

jayadeep-km-sonarsource deleted the renovate/github-actions branch February 9, 2026 08:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update GitHub actions#192

Update GitHub actions#192
jayadeep-km-sonarsource merged 1 commit intomasterfrom
renovate/github-actions

renovate bot commented Dec 19, 2025 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod bot commented Dec 19, 2025 •

edited by atlassian bot

Loading

Uh oh!

sonarqubecloud bot commented Jan 8, 2026

Uh oh!

sonarqubecloud bot commented Feb 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

[v1.2.1] – Security: Dependency upgrades and lifecycle date extension

Upgrade steps

Breaking changes

New features

Bug fixes

Performance improvements

Other changes

[v1.2.0] - Improvement: Faster and more reliable tool downloads

Upgrade steps

Breaking changes

New features

Bug fixes

Performance improvements

Other changes

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

hashicorp-vault-sonar-prod bot commented Dec 19, 2025 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Jan 8, 2026

Quality Gate passed

Uh oh!

sonarqubecloud bot commented Feb 9, 2026

SonarQube reviewer guide

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Dec 19, 2025 •

edited

Loading

hashicorp-vault-sonar-prod bot commented Dec 19, 2025 •

edited by atlassian bot

Loading