[tomverin]

Summary

• Pin the three S3 cache steps in action.yml to step-security/runs-on-cache v5.0.8 (e61ed9b0206c630e9a6bb5f12ca4cd78ae7bbe93) instead of runs-on/cache v5.0.7.
• The two restore steps (probe and restore-only) and the combined save step move together. The save step's post action is what writes the cache back to S3 after the credential guard.
• Inputs and outputs we read match the upstream v5.0.7 action. v5.0.8 is the release that runs the StepSecurity subscription check at the start. The pin is a commit SHA, not the floating v5 tag.
• Jira: https://sonarsource.atlassian.net/browse/BUILD-13160

This does not move the v1 branch. Consumers of @v1 stay on runs-on/cache until v1.7.4 is released.

Test plan

• S3 jobs in test-action.yml pass on sonar-xs, including probe, combined save, and test-s3-cache-skip-redundant-save
• A subscription-check failure on a private runner stops the ticket rather than swapping to a different action
• action.yml no longer references runs-on/cache
• After merge, cut v1.7.4 and move v1 only with an explicit go-ahead

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[hashicorp-vault-sonar-prod]

BUILD-13160

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Replacing the S3 restore/save action with a different pinned implementation could alter cache reads or writes; its code is not included in the diff.

Pins the three S3 cache steps in action.yml to step-security/runs-on-cache v5.0.8 by commit SHA instead of runs-on/cache v5.0.7, so the restore, probe, and combined save steps move together. No issues found.

Verification Rules 3/3 met Repos 1 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact Repos 1 inspected

Cross-repo 1 repository inspected 0 open impacts

SonarSource/sonar-dummy-js Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud