[tomverin]

Summary

• Pin jdx/mise-action v5.1.1 to step-security/mise-action v5.1.2 (a225bbd7c202ddf57dd76dff22bb7992f6314173) in the published composite actions and the test workflows that call it directly.
• Pin re-actors/alls-green v1.3.0 to step-security/alls-green v1.3.0 (42a30a1f2469c81cb95ae89a722da4c1c4fcc240) in .github/workflows/test-build-number.yml.
• Leave config-gradle/action.yml on gradle/actions/setup-gradle v6.4.0. step-security/gradle-actions publishes setup-gradle only on major v5 (latest release v5.0.1); there is no v6 tag, so the major is unchanged.

https://sonarsource.atlassian.net/browse/BUILD-13184

Test plan

• Required CI checks are green, including StepSecurity checks. Gitar submitted a review (approved with suggestions) and the Gitar check passed.
• Public CI did not prove the subscription check. Jobs that ran the new pins printed Free for public repositories.
• Fully tested on a private repo. Smoke run: https://github.com/SonarSource/sonar-dummy/actions/runs/39929826658 (subscription-smoke on sonar-xs, green). The composites need Vault and sibling actions, so the smoke called the pinned SHAs directly: step-security/mise-action@a225bbd7c202ddf57dd76dff22bb7992f6314173 and step-security/alls-green@42a30a1f2469c81cb95ae89a722da4c1c4fcc240.
• Executed log output showed StepSecurity Maintained Action / Secure drop-in replacement for jdx/mise-action and Secure drop-in replacement for re-actors/alls-green. REPO_PRIVATE was true. The subscription check concluded success. The step output did not print Free for public repositories, This action requires a StepSecurity subscription, or Timeout or API not reachable. Those three strings appear only inside the alls-green script text that Actions echoes before the step runs.
• Smoke branch chore/tom/BUILD-13184-subscription-smoke was deleted. The workflow is not on sonar-dummy master. No pull request was opened on sonar-dummy.
• No release was cut and no consumer branch was moved.

[hashicorp-vault-sonar-prod]

BUILD-13184

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Replacing pinned mise and alls-green actions across shared composites and CI workflows could change setup or job-gating behavior and disrupt builds.

Pins third-party actions to StepSecurity forks: jdx/mise-action becomes step-security/mise-action v5.1.2 in the composite actions and test workflows, and re-actors/alls-green becomes step-security/alls-green v1.3.0 in test-build-number.yml. config-gradle/action.yml stays on gradle/actions/setup-gradle v6.4.0 because no StepSecurity v6 tag exists. The README mise examples now point to step-security/mise-action, resolving the earlier finding. No issues remain open.

✅ 1 closed

✅ Quality: README examples still tell consumers to use jdx/mise-action

📄 build-npm/action.yml:124 📄 config-uv/action.yml
After this PR, every composite action and test workflow uses step-security/mise-action@a225bbd… # v5.1.2. The README examples still tell consumers to add jdx/mise-action themselves: 5ac50f7… # v3.2.0 in the working-directory workaround for build-gradle, and 1648a78… # v4.0.1 in the config-uv usage example. So consumers copying the docs get the upstream action that this PR moves away from, and an older major version than the actions now use. Point both snippets at the same step-security/mise-action pin.

Verification Rules 2/2 met PRs 2 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 361: Update GitHub actions Inspected
PR 363: SC-60373 Use WIF to authenticate SonarQube Cloud scans in build actions Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud