[tomverin]

Summary

• Pin jdx/mise-action v4.0.1 to step-security/mise-action v4.0.1 (c7396e2a2a4ad1ea43abee3317d964292da354ae) in test-action.yml and test-cache-migration-gh2s3.yml. That SHA is the released v4.0.1 tag, not the floating v4 tag (v4.2.4) and not the jdx commit.
• Pin re-actors/alls-green v1.2.2 to step-security/alls-green v1.3.0 (42a30a1f2469c81cb95ae89a722da4c1c4fcc240), the current released tag on major v1. The pin is that tag's commit SHA, not @v1.
• The published action.yml is unchanged. This does not move v1 and does not cut a release.

https://sonarsource.atlassian.net/browse/BUILD-13187

Test plan

Fully tested.

Public CI does not prove the StepSecurity subscription check. This repository is public, and the new actions logged ✓ Free for public repositories, which means the check was skipped.

• Test workflow: https://github.com/SonarSource/gh-action_cache/actions/runs/39929405775
  • Job All Tests, step-security/alls-green@42a30a1f2469c81cb95ae89a722da4c1c4fcc240: StepSecurity Maintained Action, then ✓ Free for public repositories.
• Cache migration workflow: https://github.com/SonarSource/gh-action_cache/actions/runs/39929405488
  • Job All Tests - Cache Migration logged the same skip line.
• test-github-cache logged the same skip line for step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae.

Private smoke on SonarSource/sonar-dummy-yarn (private: true). Temporary branch chore/tom/BUILD-13187-subscription-smoke, runs-on: sonar-xs, permissions id-token: write and contents: read. No pull request. The branch was deleted after the run.

• Run: https://github.com/SonarSource/sonar-dummy-yarn/actions/runs/39930369963 (success)
• Runtime lines from job smoke:
  • step-security/mise-action@c7396e2a2a4ad1ea43abee3317d964292da354ae: StepSecurity Maintained Action and Learn more: https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions
  • step-security/alls-green@42a30a1f2469c81cb95ae89a722da4c1c4fcc240 subscription check: StepSecurity Maintained Action and the same learn-more line
• Those runtime lines do not include Free for public repositories, This action requires a StepSecurity subscription, or Timeout or API not reachable.

Required checks are green, including All Tests, All Tests - Cache Migration, pre-commit, SonarCloud Code Analysis, tests-credential-isolation, StepSecurity Required Checks, and verify-sca. Gitar submitted an approval and did not ask for a pin change.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Replacing pinned test-workflow actions with StepSecurity versions changes CI setup and job gating, which could cause tests to run or report differently.

Pins jdx/mise-action and re-actors/alls-green in test-action.yml and test-cache-migration-gh2s3.yml to StepSecurity forks at specific commit SHAs, leaving the published action.yml and the v1 tag untouched. No issues found.

Verification Rules 3/3 met PRs 1 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 1 inspected

Cross-PR 1 PR inspected 0 open impacts

PR 95: Update GitHub actions (major) Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[hashicorp-vault-sonar-prod]

BUILD-13187