From 52b158cbe4cca605eb5a8847a6556c5f29be6b1a Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 10:08:23 +0000 Subject: [PATCH 1/2] Update GitHub Actions dependencies --- .github/workflows/build.yml | 26 +++++++++++++------------- .github/workflows/pr_cleanup.yml | 2 +- .github/workflows/release.yml | 2 +- 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b7fa6c73..ab02b24b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,23 +21,23 @@ jobs: runs-on: github-ubuntu-latest-s timeout-minutes: 30 steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: version: 2026.10.10 tool_versions: | java temurin-21 - - uses: SonarSource/ci-github-actions/build-maven@v1 + - uses: SonarSource/ci-github-actions/build-maven@v2 with: artifactory-reader-role: private-reader artifactory-deployer-role: qa-deployer deploy-pull-request: true - name: Upload test results on failure if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: test-results path: '**/target/surefire-reports/**/*.xml' @@ -60,9 +60,9 @@ jobs: - SQ_VERSION: LATEST_RELEASE[2025.1] JAVA_VERSION: 17 steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: version: 2026.10.10 tool_versions: | @@ -76,7 +76,7 @@ jobs: development/github/token/licenses-ro token | GITHUB_TOKEN - name: Configure Maven - uses: SonarSource/ci-github-actions/config-maven@v1 + uses: SonarSource/ci-github-actions/config-maven@v2 with: artifactory-reader-role: private-reader @@ -87,14 +87,14 @@ jobs: - name: Upload server logs if: failure() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: server-logs-${{ github.job }}-${{ strategy.job-index }} path: "**/target/**/logs/**.log" if-no-files-found: ignore - name: Upload test results - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: failure() with: name: test-results-${{ github.job }}-${{ strategy.job-index }} @@ -106,12 +106,12 @@ jobs: needs: qa runs-on: github-ubuntu-latest-s steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: cache_save: false version: 2026.10.10 - - uses: SonarSource/ci-github-actions/get-build-number@v1 - - uses: SonarSource/ci-github-actions/promote@v1 + - uses: SonarSource/ci-github-actions/get-build-number@v2 + - uses: SonarSource/ci-github-actions/promote@v2 with: promote-pull-request: true diff --git a/.github/workflows/pr_cleanup.yml b/.github/workflows/pr_cleanup.yml index b074bc62..41e1b4e6 100644 --- a/.github/workflows/pr_cleanup.yml +++ b/.github/workflows/pr_cleanup.yml @@ -8,4 +8,4 @@ jobs: permissions: actions: write steps: - - uses: SonarSource/ci-github-actions/pr_cleanup@v1 + - uses: SonarSource/ci-github-actions/pr_cleanup@v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 99760c5e..2975f70d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,7 +10,7 @@ jobs: permissions: contents: write id-token: write - uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v6 + uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v7 with: publishToBinaries: true mavenCentralSync: true From 3d96c8d99b843efe9106c9606ed020e8b19c73f2 Mon Sep 17 00:00:00 2001 From: Michal Zgliczynski Date: Tue, 20 Oct 2026 14:08:18 +0200 Subject: [PATCH 2/2] Migrate release workflow to v7 draft-first flow --- .github/workflows/release.yml | 12 ++++++++---- RELEASE.md | 19 +++++++++++++++++++ 2 files changed, 27 insertions(+), 4 deletions(-) create mode 100644 RELEASE.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2975f70d..cc209a35 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,9 +1,12 @@ name: Release -# This workflow is triggered when publishing a GitHub release +# Run manually with the full version of an existing build to release. on: - release: - types: - - published + workflow_dispatch: + inputs: + version: + description: 'Full version including build number, e.g. 1.2.3.456' + type: string + required: true jobs: run_release: @@ -12,6 +15,7 @@ jobs: id-token: write uses: SonarSource/gh-action_release/.github/workflows/main.yaml@v7 with: + version: ${{ inputs.version }} publishToBinaries: true mavenCentralSync: true slackChannel: ops-ci-experience diff --git a/RELEASE.md b/RELEASE.md new file mode 100644 index 00000000..3cc4e0df --- /dev/null +++ b/RELEASE.md @@ -0,0 +1,19 @@ +# Releasing + +The [Release workflow](https://github.com/SonarSource/sonar-scanner-java-library/actions/workflows/release.yml) +uses the [v7 draft-first release flow](https://github.com/SonarSource/gh-action_release/blob/v7/README.md#migrating-from-v6-to-v7-draft-first-workflow_dispatch). + +1. Select the branch or commit corresponding to the successfully built and promoted version. +2. Go to **Actions → Release → Run workflow**, select that ref, and enter the full version including its build number (for example, `1.2.3.456`). + Alternatively, from this repository, run: + + ```sh + gh workflow run release.yml --ref -f version= + ``` + +The workflow creates or reuses a draft GitHub release, runs releasability checks, promotes the artifacts, +publishes to binaries and Maven Central, and publishes the GitHub release after those steps succeed. +Publishing a release manually in the GitHub UI no longer starts the release workflow. + +If the workflow fails, fix the cause and re-run the failed workflow from GitHub Actions with the same version. +The draft is retained for retries; a rebuild is not required. An already published release cannot be reused.