chore(deps): bump SonarSource/sonarqube-scan-action from 6.0.0 to 8.2.0#179
Conversation
Bumps [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) from 6.0.0 to 8.2.0. - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](SonarSource/sonarqube-scan-action@fd88b7d...7138816) --- updated-dependencies: - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
|
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| fetch-depth: 0 | ||
| - name: SonarCloud Scan | ||
| uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0 | ||
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 |
There was a problem hiding this comment.
WARNING: Breaking change — skipSignatureVerification now defaults to false
v8.0.0 introduced a breaking change where the skipSignatureVerification input defaults to false. This workflow does not explicitly set it, so the action will now attempt GPG signature verification on scanner downloads. If keyserver access or GPG setup is not reliable in this environment, the scan will fail to execute entirely (the continue-on-error: true mask may prevent pipeline failure but will also hide the issue).
Recommend explicitly setting skipSignatureVerification: true to preserve the previous v6 behavior, or verifying locally that signature verification succeeds in your CI environment.
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 | |
| uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 | |
| with: | |
| skipSignatureVerification: true |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 1 Warning Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (1 file)
Fix these issues in Kilo Cloud Reviewed by step-3.7-flash-20260528 · Input: 82.7K · Output: 3.3K · Cached: 218.6K |
Bumps SonarSource/sonarqube-scan-action from 6.0.0 to 8.2.0.
Release notes
Sourced from SonarSource/sonarqube-scan-action's releases.
... (truncated)
Commits
7138816SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows (#251)3581139SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4...c9d327cSQSCANGHA-84 Remove outdated wget/curl referencesb243e51SQSCANGHA-88 Deprecate the SONARCLOUD_URL env variable support375c3f5SQSCANGHA-149 Add scannerBinariesAuthHeader input for authenticated binary do...9c78323SQSCANGHA-144 Add gate jobs to QA workflows for branch protection7006c44Update SonarScanner CLI to 8.1.0.6389edd319fNO-JIRA Bump actions/setup-node from 6.3.0 to 6.4.0 (#234)e050aa9NO-JIRA Bump actions/cache from 5.0.4 to 5.0.5 (#231)6cd3d8fNO-JIRA Bump madhead/semver-utils from 4.3.0 to 5.0.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Bump
SonarSource/sonarqube-scan-actionfrom v6.0.0 to v8.2.0Updates the pinned action version in sonarcloud.yml to use the latest release.
Macroscope summarized 3abc3e6.