Skip to content

bot: bump SonarSource/sonarqube-scan-action from 5.2.0 to 5.3.1 #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dependabot wants to merge 1 commit into from
Closed

bot: bump SonarSource/sonarqube-scan-action from 5.2.0 to 5.3.1 #41

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 1, 2025 •
edited
Loading

Bumps SonarSource/sonarqube-scan-action from 5.2.0 to 5.3.1.

Release notes

Sourced from SonarSource/sonarqube-scan-action's releases.

v5.3.1

What's Changed

New Contributors

Full Changelog: SonarSource/sonarqube-scan-action@v5...v5.3.1

v5.3.0

What's Changed

New Contributors

Full Changelog: SonarSource/sonarqube-scan-action@v5.2.0...v5.3.0

Commits
  • 1a6d90e SQSCANGHA-102 Pin actions/cache to a full-length commit SHA (#199)
  • 016cabf SQSCANGHA-101 Add more command injection tests
  • 5fc8cfc SQSCANGHA-101 Fix sha256 check in QA Deprecated C/C++ action
  • 786af10 NO-JIRA Bump actions/checkout from 4 to 5
  • 01850e2 SQSCANGHA-94 Fix the scanner-update workflow
  • 8c71dc0 SQSCANGHA-98 Update SonarScanner CLI to 7.2.0.5079 (#196)
  • ef211f9 SQSCANGHA-97 Use /usr/bin/env for shebang (#193)
  • 74f62c9 BUILD-8073 Migrate public repositories workflows to large runners
  • c8aa051 SQSCANGHA-83 Avoid unbound variable error on parameter expansion (#192)
  • bfe63be SQSCANGHA-95 Update CODEOWNERS (#190)
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once CI passes on it, as requested by @Klintrup.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
bot: bump SonarSource/sonarqube-scan-action from 5.2.0 to 5.3.1
b429256 
Bumps [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) from 5.2.0 to 5.3.1.
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](SonarSource/sonarqube-scan-action@2500896...1a6d90e)

---
updated-dependencies:
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2025
@dependabot dependabot bot requested a review from Klintrup as a code owner September 1, 2025 17:17
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2025
@dependabot dependabot bot mentioned this pull request Sep 1, 2025
Closed
@codara-ai-code-review
Copy link

codara-ai-code-review bot commented Sep 1, 2025

Potential issues, bugs, and flaws that can introduce unwanted behavior:

  1. /.github/workflows/sonarcloud.yml - Change to SonarQube Version: Upgrading from version v5.2.0 to v5.3.1 may introduce breaking changes or new behaviors that are incompatible with the expected setup. It's crucial to review the release notes for v5.3.0 and v5.3.1 to ensure that the new version behaves as expected in your environment and does not introduce any regressions.

Code suggestions and improvements for better exception handling, logic, standardization, and consistency:

  1. /.github/workflows/sonarcloud.yml - Add Job Output Logging: Consider adding logging for the results of the SonarQube scan. This will make it easier to troubleshoot issues if the scan fails or if unexpected results are detected. You can use the run step to capture and log the output of the SonarQube command.

  2. /.github/workflows/sonarcloud.yml - Standardize Version Tag Management: Instead of hardcoding the exact commit hash for the SonarSource action, consider specifying the semantic version directly (e.g., @v5.3.1). This practice can improve clarity regarding which version is in use and help avoid potential issues related to a specific commit that could be altered later.

  3. /.github/workflows/sonarcloud.yml - Ensure Newline at End of File: It's a best practice to end YAML files with a newline. This can prevent certain tools or editors from misinterpreting the file, especially in a CI/CD pipeline context.

@github-actions
Copy link

github-actions bot commented Sep 1, 2025

🦙 MegaLinter status: ✅ SUCCESS

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ BASH bash-exec 1 0 0 0.22s
✅ BASH shellcheck 1 0 0 0.08s
✅ BASH shfmt 1 0 0 0 0.01s
✅ COPYPASTE jscpd yes no no 1.26s
✅ MARKDOWN markdownlint 2 0 0 0 0.52s
✅ MARKDOWN markdown-link-check 3 0 0 3.05s
✅ MARKDOWN markdown-table-formatter 3 0 0 0 0.17s
✅ REPOSITORY checkov yes no no 10.21s
✅ REPOSITORY gitleaks yes no no 0.06s
✅ REPOSITORY git_diff yes no no 0.0s
✅ REPOSITORY grype yes no no 24.07s
✅ REPOSITORY syft yes no no 1.08s
✅ REPOSITORY trivy yes no no 5.07s
✅ REPOSITORY trivy-sbom yes no no 0.09s
✅ REPOSITORY trufflehog yes no no 2.13s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by OX Security

@Klintrup
Copy link
Owner

Klintrup commented Sep 1, 2025 via email

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 22, 2025

Superseded by #43.

@dependabot dependabot bot closed this Sep 22, 2025
@dependabot dependabot bot deleted the dependabot/github_actions/SonarSource/sonarqube-scan-action-5.3.1 branch September 22, 2025 08:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Klintrup Klintrup Awaiting requested review from Klintrup Klintrup is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Klintrup