bot: bump SonarSource/sonarqube-scan-action from 5.2.0 to 5.3.0

[dependabot]

Bumps SonarSource/sonarqube-scan-action from 5.2.0 to 5.3.0.

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v5.3.0

What's Changed

• SQSCANGHA-83 Avoid unbound variable error on parameter expansion by @​aleksandra-bozhinoska-sonarsource in SonarSource/sonarqube-scan-action#192
• SQSCANGHA-97 Use /usr/bin/env for shebang by @​eliandoran in SonarSource/sonarqube-scan-action#193
• SQSCANGHA-98 Update SonarScanner CLI to 7.2.0.5079 by @​github-actions[bot] in SonarSource/sonarqube-scan-action#196

New Contributors

• @​eliandoran made their first contribution in SonarSource/sonarqube-scan-action#193

Full Changelog: SonarSource/sonarqube-scan-action@v5.2.0...v5.3.0

Commits

• 8c71dc0 SQSCANGHA-98 Update SonarScanner CLI to 7.2.0.5079 (#196)
• ef211f9 SQSCANGHA-97 Use /usr/bin/env for shebang (#193)
• 74f62c9 BUILD-8073 Migrate public repositories workflows to large runners
• c8aa051 SQSCANGHA-83 Avoid unbound variable error on parameter expansion (#192)
• bfe63be SQSCANGHA-95 Update CODEOWNERS (#190)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

The reviewers field in the dependabot.yml file will be removed soon. Please use the code owners file to specify reviewers for Dependabot PRs. For more information, see this blog post.

[codara-ai-code-review]

Potential issues, bugs, and flaws that can introduce unwanted behavior:

1. /.github/workflows/sonarcloud.yml - Version Locking: The change from a specific commit hash (2500896589ef8f7247069a56136f8dc177c27ccf) to another commit hash (8c71dc039c2dd71d3821e89a2b58ecc7fee6ced9) indicates an upgrade in the SonarQube scan action. If the new version has breaking changes or bugs, it could potentially disrupt your CI/CD pipeline without thorough testing of the upgrade.

Code suggestions and improvements for better exception handling, logic, standardization, and consistency:

1. /.github/workflows/sonarcloud.yml - Use Tagged Releases: Instead of using a specific commit hash, consider tagging releases (e.g., v5.3.0) for the SonarQube scan action. This practice enhances clarity regarding the version being used and allows for easier updates in the future (e.g., uses: SonarSource/sonarqube-scan-action@v5.3.0).

2. /.github/workflows/sonarcloud.yml - Add Error Handling: While not directly addressed in this change, add a step for capturing and reporting errors from the SonarQube scan job. This might involve utilizing a tool or GitHub Action that can notify or fail the workflow based on the scan results, improving visibility and accountability of code quality metrics.

3. /.github/workflows/sonarcloud.yml - Add a Comment Describing the Change: Adding a comment near the line where the version is changed can be beneficial for future maintainers. It ensures that team members understand why the version was upgraded, potentially preventing future confusion. For example, # Upgraded to v5.3.0 for XYZ feature improvements.

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ BASH	bash-exec	1		0	0	0.2s
✅ BASH	shellcheck	1		0	0	0.08s
✅ BASH	shfmt	1	0	0	0	0.01s
✅ COPYPASTE	jscpd	yes		no	no	1.16s
✅ MARKDOWN	markdownlint	2	0	0	0	0.51s
✅ MARKDOWN	markdown-link-check	3		0	0	4.74s
✅ MARKDOWN	markdown-table-formatter	3	0	0	0	0.17s
✅ REPOSITORY	checkov	yes		no	no	10.72s
✅ REPOSITORY	gitleaks	yes		no	no	0.06s
✅ REPOSITORY	git_diff	yes		no	no	0.0s
✅ REPOSITORY	grype	yes		no	no	23.37s
✅ REPOSITORY	syft	yes		no	no	1.12s
✅ REPOSITORY	trivy	yes		no	no	6.59s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.08s
✅ REPOSITORY	trufflehog	yes		no	no	2.12s

See detailed report in MegaLinter reports

[dependabot]

Superseded by #41.