From ad6a02b387abde56b7fbf74cae4b2a8dcaf4cd74 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 19 Jul 2026 07:12:34 +0000 Subject: [PATCH 1/2] chore: bump actions/download-artifact from 4 to 8 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 11162f1..759c8df 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,7 +56,7 @@ jobs: with: fetch-depth: 0 - name: Download coverage report - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: coverage-report - name: SonarCloud Scan From 3a6eb96af029ccd67e0f12b334aed025b65d0430 Mon Sep 17 00:00:00 2001 From: Brad Edwards Date: Sun, 19 Jul 2026 18:54:18 +0200 Subject: [PATCH 2/2] ci: handle Dependabot Sonar scans --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 759c8df..6e11b13 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -60,6 +60,10 @@ jobs: with: name: coverage-report - name: SonarCloud Scan + if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + - name: Skip SonarCloud scan for Dependabot + if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' + run: echo "SonarCloud credentials are unavailable to Dependabot pull requests."