Update GitHub actions (major) by renovate[bot] · Pull Request #95 · SonarSource/gh-action_cache

renovate · 2026-08-31T12:51:17Z

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/ci-github-actions	action	major	`v1` → `v2`
actions/cache	action	major	`v5.0.5` → `v6.1.0`
actions/checkout	action	major	`v6.0.2` → `v7.0.1`
step-security/mise-action	action	major	`v4.0.1` → `v5.1.2`

Release Notes

SonarSource/ci-github-actions

`v2`

Compare Source

actions/cache

`v6.1.0`

Compare Source

What's Changed

Bump @actions/cache to v6.1.0 - handle read-only cache access by @jasongin in #1768

Full Changelog: actions/cache@v6...v6.1.0

`v6.0.0`

Compare Source

What's Changed

Update packages, migrate to ESM by @Samirat in #1760

Full Changelog: actions/cache@v5...v6.0.0

`v5.1.0`

Compare Source

What's Changed

Bump @actions/cache to v5.1.0 - handle read-only cache access by @jasongin in #1775

Full Changelog: actions/cache@v5...v5.1.0

actions/checkout

`v7.0.1`

Compare Source

Skip running unsafe pr check if input is default by @aiqiaoy in #2518
Trim only ascii whitespace for branch by @aiqiaoy in #2521
Escape values passed to --unset by @aiqiaoy in #2530
Various dependency updates

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Various dependency updates

`v6.1.0`

Compare Source

What's Changed

[BREAKING] backport allow-unsafe-pr-checkout to v6 by @aiqiaoy in #2500
backport fixes to releases-v6 by @aiqiaoy in #2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

step-security/mise-action

`v5.1.2`

Compare Source

What's Changed

chore(deps): bump actions/dependency-review-action from 67d4f4b to 1e966ba by @dependabot[bot] in #226
chore(deps): bump github/codeql-action/init from 3.28.16 to 4.37.9 by @dependabot[bot] in #225
fix: Security updates by @github-actions[bot] in #228
fix: Security updates by @github-actions[bot] in #232
chore(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.4 by @dependabot[bot] in #224
fix: Security updates by @github-actions[bot] in #235
chore: Cherry-pick changes from upstream by @anurag-stepsecurity in #234
chore: sync with upstream v5.1.2 by @anurag-stepsecurity in #240
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #229
chore: add dev deps to ignore them by @anurag-stepsecurity in #241

Full Changelog: step-security/mise-action@v4.2.4...v5.1.2

`v5`

Compare Source

`v4.2.4`

Compare Source

What's Changed

chore(deps): bump actions/checkout from 4.2.2 to 7.0.1 by @dependabot[bot] in #118
chore(deps): bump step-security/harden-runner from 2.12.0 to 2.20.1 by @dependabot[bot] in #140
fix: Security updates by @github-actions[bot] in #222
chore: Cherry-pick changes from upstream by @anurag-stepsecurity in #221
[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in #227

Full Changelog: step-security/mise-action@v4.2.0...v4.2.4

`v4.2.0`

Compare Source

What's Changed

chore: Remove guarddog.yml by @anurag-stepsecurity in #209
fix: Security updates by @github-actions[bot] in #210
fix: Security updates by @github-actions[bot] in #211
[StepSecurity] Apply security best practices by @step-security-bot in #213
fix: Security updates by @github-actions[bot] in #214
fix: Security updates by @github-actions[bot] in #215
chore: Cherry-picked changes from upstream by @anurag-stepsecurity in #218
[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in #219

New Contributors

@anurag-stepsecurity made their first contribution in #209

Full Changelog: step-security/mise-action@v4...v4.2.0

Configuration

📅 Schedule: (in timezone Europe/Paris)

Branch creation
- "after 7am every weekday,before 8pm every weekday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

datadog-sonarsource · 2026-10-22T12:26:49Z

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 12 Pipeline jobs failed

Test | All Tests

View more details · View in GitHub Actions

Test | test-cache-metrics-output

View more details · View in GitHub Actions

Test | test-cache-metrics-runner-hook

View more details · View in GitHub Actions

View all 12 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 0501922 | Docs | View more details | Give us feedback!}

gitar-bot · 2026-10-23T09:16:39Z

@@ -13,13 +13,13 @@ jobs:
      id-token: write
      contents: read


⚠️ Bug: config-pip@v2 needs contents: write; test jobs still grant read

This PR moves 10 jobs in test-action.yml to SonarSource/ci-github-actions/config-pip@v2, but each of those jobs still declares permissions: contents: read. In v2, config-pip runs get-build-number, which now claims build numbers by creating refs/build-number/* Git refs with github.token. The ci-github-actions v2 README marks this as a breaking change: it requires contents: write, and with contents: read every new claim fails with a 403. See also the v2 get-build-number action, which sets GITHUB_TOKEN: ${{ github.token }}. As a result, these jobs fail at the config-pip step and never reach the cache tests, so all-green fails as well. The fix is to change contents: read to contents: write in every job that uses config-pip@v2. Another option is to pin config-pip to v1 until the permissions change is accepted.

In each job that runs config-pip@v2, grant contents: write:

permissions: id-token: write contents: write

Apply fix

_{Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎}

sonarqube-cloud-us · 2026-10-23T14:01:09Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2026-10-23T14:01:24Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

gitar-bot · 2026-10-23T14:01:43Z

CI failed: Renovate's GitHub Actions major update fails in the shared get-build-number step: the calling workflow token has only contents: read, and the action needs contents: write to create a Git ref. The PR's relation to this is unclear, and the All Tests aggregate failure is a separate test-github-cache failure with no failing step shown.

Overview

Four unique error templates across 31 analyzed logs. Three findings share one root cause (a 403 from the get-build-number action), and one is an aggregate All Tests failure whose underlying job log was not provided. No logs were conclusively tied to the PR changes, and the change context contains only the title and commit metadata, not the workflow edits.

Failures

Get-build-number 403: workflow token lacks contents: write (confidence: high)

Type: authentication
Affected jobs: 120455845056, 120455844817, 120455844843, 120455845228, 120455845390, 117458359933, 117458360275 (log-reported job IDs from findings 1-3; the log-reported IDs in finding 3 differ from the other jobs and should be checked against the run)
Related to change: unclear
Root cause: The get-build-number action calls gh to create a Git ref and GitHub returns 403 Resource not accessible by integration, stating the calling workflow needs contents: write (contents: read is insufficient). Downstream skipped steps cascade from this. The PR updates action versions, but the supplied context does not show whether workflow permissions changed, so the link to the PR is unestablished.
Suggested fix: Grant permissions: contents: write to the calling workflow or job that runs the build-number action (narrowest scope). Alternatively, change the action or its configuration so it does not create a Git ref and works with contents: read. Verify whether the Renovate update altered the action's token usage or the workflow's permissions block.

All Tests aggregate failure from test-github-cache (confidence: high)

Type: test
Affected jobs: 120456362178 (All Tests / alls-green), with failing required job test-github-cache
Related to change: unclear
Root cause: The alls-green gate reports test-github-cache as failure while test-s3-cache-with-fallback succeeded. The log contains only the aggregate status, not the failing step or error, so the underlying cause is not identified.
Suggested fix: Open the full test-github-cache job log, find its first failing step, fix that specific error, and rerun. Do not treat this as the same cause as the 403 without that evidence.

Summary

Change-related failures: None confirmed. All findings are marked related_to_pr unclear.
Infrastructure/flaky failures: None identified as flaky. The 403 is a permissions configuration problem, not an infrastructure fault.
Recommended action: Fix the calling workflow's contents permission for the get-build-number step (or its token usage), then inspect the test-github-cache job log to identify its failing step. Confirm whether the Renovate major update changed permissions or action behavior, since the PR's workflow diff was not provided.

Code Review ⚠️ Changes requested 0 closed / 1 findings

🟡 Medium risk · Upgrading cache, checkout, and setup actions across runtime and workflows could disrupt cache restores or CI jobs if major-version changes are incompatible.

Updates GitHub Actions to new major versions, including SonarSource/ci-github-actions to v2, actions/cache to v6.1.0, and actions/checkout to v7.0.1. Changes requested: config-pip@v2 requires contents: write, but the 10 jobs in .github/workflows/test-action.yml that use it still declare contents: read, so they fail with 403 at the config-pip step and block all-green. Fix by granting contents: write in those jobs or pinning config-pip to v1.

⚠️

Bug: config-pip@v2 needs contents: write; test jobs still grant read

This PR moves 10 jobs in test-action.yml to SonarSource/ci-github-actions/config-pip@v2, but each of those jobs still declares permissions: contents: read. In v2, config-pip runs get-build-number, which now claims build numbers by creating refs/build-number/* Git refs with github.token. The ci-github-actions v2 README marks this as a breaking change: it requires contents: write, and with contents: read every new claim fails with a 403. See also the v2 get-build-number action, which sets GITHUB_TOKEN: ${{ github.token }}. As a result, these jobs fail at the config-pip step and never reach the cache tests, so all-green fails as well. The fix is to change contents: read to contents: write in every job that uses config-pip@v2. Another option is to pin config-pip to v1 until the permissions change is accepted.

In each job that runs config-pip@v2, grant contents: write

permissions:
  id-token: write
  contents: write

🤖 Prompt for agents

Code Review: Updates GitHub Actions to new major versions, including `SonarSource/ci-github-actions` to `v2`, `actions/cache` to `v6.1.0`, and `actions/checkout` to `v7.0.1`. Changes requested: `config-pip@v2` requires `contents: write`, but the 10 jobs in `.github/workflows/test-action.yml` that use it still declare `contents: read`, so they fail with 403 at the config-pip step and block `all-green`. Fix by granting `contents: write` in those jobs or pinning config-pip to v1.

1. ⚠️ Bug: config-pip@v2 needs contents: write; test jobs still grant read
   Files: .github/workflows/test-action.yml:14, .github/workflows/test-action.yml:17, .github/workflows/test-action.yml:50, .github/workflows/test-action.yml:53, .github/workflows/test-action.yml:134, .github/workflows/test-action.yml:137, .github/workflows/test-action.yml:181, .github/workflows/test-action.yml:184, .github/workflows/test-action.yml:215, .github/workflows/test-action.yml:218, .github/workflows/test-action.yml:260, .github/workflows/test-action.yml:263, .github/workflows/test-action.yml:332, .github/workflows/test-action.yml:335, .github/workflows/test-action.yml:371, .github/workflows/test-action.yml:376, .github/workflows/test-action.yml:411, .github/workflows/test-action.yml:417, .github/workflows/test-action.yml:521, .github/workflows/test-action.yml:525, .github/workflows/test-action.yml:584, .github/workflows/test-action.yml:589

   This PR moves 10 jobs in `test-action.yml` to `SonarSource/ci-github-actions/config-pip@v2`, but each of those jobs still declares `permissions: contents: read`. In v2, config-pip runs `get-build-number`, which now claims build numbers by creating `refs/build-number/*` Git refs with `github.token`. The [ci-github-actions v2 README](https://raw.githubusercontent.com/SonarSource/ci-github-actions/v2/README.md) marks this as a breaking change: it requires `contents: write`, and with `contents: read` every new claim fails with a 403. See also the [v2 get-build-number action](https://raw.githubusercontent.com/SonarSource/ci-github-actions/v2/get-build-number/action.yml), which sets `GITHUB_TOKEN: ${{ github.token }}`. As a result, these jobs fail at the config-pip step and never reach the cache tests, so `all-green` fails as well. The fix is to change `contents: read` to `contents: write` in every job that uses config-pip@v2. Another option is to pin config-pip to v1 until the permissions change is accepted.

   Fix (In each job that runs config-pip@v2, grant contents: write):
   permissions:
     id-token: write
     contents: write

Verification Rules 3/3 met PRs 2 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 103: BUILD-13187: Pin test workflows to StepSecurity Inspected
PR 361: Update GitHub actions Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.
Unblock → Override a blocking verdict and allow merging.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`	`Unblock`
`gitar auto-apply:on`	`gitar display:verbose`	`gitar unblock`

_{Was this helpful? React with 👍 / 👎 | Gitar}

renovate Bot requested a review from a team as a code owner August 31, 2026 12:51

renovate Bot added the dependencies label Aug 31, 2026

renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 6001e88 to 0360d67 Compare September 9, 2026 15:32

renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 3c4e6e0 to 583093c Compare September 20, 2026 03:55

renovate Bot force-pushed the renovate/major-github-actions branch from 583093c to e2346e1 Compare September 23, 2026 08:35

renovate Bot force-pushed the renovate/major-github-actions branch 4 times, most recently from 8982f99 to 890293f Compare October 9, 2026 22:56

renovate Bot force-pushed the renovate/major-github-actions branch 3 times, most recently from a926d5d to 91712aa Compare October 16, 2026 20:59

renovate Bot force-pushed the renovate/major-github-actions branch 2 times, most recently from bf0d1e5 to 34dfd03 Compare October 22, 2026 12:26

renovate Bot force-pushed the renovate/major-github-actions branch from 34dfd03 to 5cd3632 Compare October 23, 2026 09:10

gitar-bot Bot reviewed Oct 23, 2026

View reviewed changes

Update GitHub actions

0501922

renovate Bot force-pushed the renovate/major-github-actions branch from 5cd3632 to 0501922 Compare October 23, 2026 14:00

Navigation Menu

Repository navigation

Update GitHub actions (major) - #95

Update GitHub actions (major)#95
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-github-actions

renovate Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

datadog-sonarsource Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

gitar-bot Bot Oct 23, 2026

Uh oh!

sonarqube-cloud-us Bot commented Oct 23, 2026

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Uh oh!

gitar-bot Bot commented Oct 23, 2026 •

edited

Loading

Overview

Failures

Get-build-number 403: workflow token lacks contents: write (confidence: high)

All Tests aggregate failure from test-github-cache (confidence: high)

Summary

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

Configuration

Uh oh!

datadog-sonarsource Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Errors

Uh oh!

gitar-bot Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqube-cloud-us Bot commented Oct 23, 2026

Quality Gate passed

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Quality Gate passed

Uh oh!

gitar-bot Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Failures

Get-build-number 403: workflow token lacks contents: write (confidence: high)

All Tests aggregate failure from test-github-cache (confidence: high)

Summary

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 31, 2026 •

edited

Loading

datadog-sonarsource Bot commented Oct 22, 2026 •

edited

Loading

gitar-bot Bot commented Oct 23, 2026 •

edited

Loading