[renovate]

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/gh-action_cache	action	pinDigest	→ a7d13cd
SonarSource/vault-action-wrapper	action	minor	3.5.0 → 3.7.0
SonarSource/vault-action-wrapper	action	minor	3.6.1 → 3.7.0
actions/cache	action	minor	v5.0.5 → v5.1.0
actions/checkout	action	minor	v6.0.2 → v6.1.0
step-security/mise-action	action	minor	v4.0.1 → v4.2.4

---

Release Notes

SonarSource/vault-action-wrapper

v3.7.0

Compare Source

What's new

• PREQ-8637: Allow workflows with issue_comment trigger to use Vault by @​matemoln in #​83 and SonarSource/re-terraform-aws-vault#9677

Full Changelog: SonarSource/vault-action-wrapper@3.6.1...3.7.0

v3.6.1

Compare Source

What's Changed

• BUILD-11126 capture network diagnostics on Vault failure by @​jayadeep-km-sonarsource in #​77

Full Changelog: SonarSource/vault-action-wrapper@3.5.1...3.6.1

v3.5.1

Compare Source

What's Changed

• PREQ-6101 Add automatic retry on transient Vault auth failure by @​mikolaj-matuszny-ext-sonarsource in #​76

New Contributors

• @​mikolaj-matuszny-ext-sonarsource made their first contribution in #​76

Full Changelog: SonarSource/vault-action-wrapper@3.5.0...3.5.1

actions/cache

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

actions/checkout

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

step-security/mise-action

v4.2.4

Compare Source

What's Changed

• chore(deps): bump actions/checkout from 4.2.2 to 7.0.1 by @​dependabot[bot] in #​118
• chore(deps): bump step-security/harden-runner from 2.12.0 to 2.20.1 by @​dependabot[bot] in #​140
• fix: Security updates by @​github-actions[bot] in #​222
• chore: Cherry-pick changes from upstream by @​anurag-stepsecurity in #​221
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in #​227

Full Changelog: step-security/mise-action@v4.2.0...v4.2.4

v4.2.0

Compare Source

What's Changed

• chore: Remove guarddog.yml by @​anurag-stepsecurity in #​209
• fix: Security updates by @​github-actions[bot] in #​210
• fix: Security updates by @​github-actions[bot] in #​211
• [StepSecurity] Apply security best practices by @​step-security-bot in #​213
• fix: Security updates by @​github-actions[bot] in #​214
• fix: Security updates by @​github-actions[bot] in #​215
• chore: Cherry-picked changes from upstream by @​anurag-stepsecurity in #​218
• [StepSecurity] ci: Harden GitHub Actions by @​step-security-bot in #​219

New Contributors

• @​anurag-stepsecurity made their first contribution in #​209

Full Changelog: step-security/mise-action@v4...v4.2.0

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "after 7am every weekday,before 8pm every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review 👍 Approved with suggestions 0 closed / 1 findings

🟡 Medium risk · Updating pinned checkout, cache, mise, and Vault actions across workflows could disrupt CI or alter how workflow secrets are retrieved.

Pins GitHub Actions dependencies to commit digests and bumps vault-action-wrapper, actions/cache, actions/checkout, and mise-action versions. One open suggestion: the symlink-keeper self-reference is now SHA-pinned, which leaves the README's tag-based dev and release procedure out of date. Consider documenting the @<sha> # symlink-keeper-x.y.z form, or excluding this self-reference from Renovate digest pinning.

💡 Quality: symlink-keeper SHA pin breaks README's tag-based dev/release procedure

📄 action.yml:405

This PR changes the internal self-reference from @symlink-keeper-1.0.0 to @a7d13cdd… # symlink-keeper-1.0.0. The SHA is correct: it is the commit the annotated tag points to, and the sub-action contents are identical to HEAD. But the README's symlink-keeper section still says the sub-action is "referenced by version tag … (e.g. @symlink-keeper-1.0.0)" and "The tag is what callers pin to in production". Step 2 of its development procedure also tells maintainers to "Update all @symlink-keeper-* references". After this PR, searching for @symlink-keeper- finds nothing, because the version only appears in a trailing comment. A maintainer following step 2 would also swap a SHA pin for a branch ref, which Renovate would then re-pin. You could update the README to describe the @<sha> # symlink-keeper-x.y.z form, including how to point to a dev branch and re-pin after the release tag is created. Or you could exclude this self-reference from Renovate digest pinning.

🤖 Prompt for agents

Code Review: Pins GitHub Actions dependencies to commit digests and bumps vault-action-wrapper, actions/cache, actions/checkout, and mise-action versions. One open suggestion: the symlink-keeper self-reference is now SHA-pinned, which leaves the README's tag-based dev and release procedure out of date. Consider documenting the `@<sha> # symlink-keeper-x.y.z` form, or excluding this self-reference from Renovate digest pinning.

1. 💡 Quality: symlink-keeper SHA pin breaks README's tag-based dev/release procedure
   Files: action.yml:405

   This PR changes the internal self-reference from `@symlink-keeper-1.0.0` to `@a7d13cdd… # symlink-keeper-1.0.0`. The SHA is correct: it is the commit the annotated tag points to, and the sub-action contents are identical to HEAD. But the README's symlink-keeper section still says the sub-action is "referenced by version tag … (e.g. `@symlink-keeper-1.0.0`)" and "The tag is what callers pin to in production". Step 2 of its development procedure also tells maintainers to "Update all `@symlink-keeper-*` references". After this PR, searching for `@symlink-keeper-` finds nothing, because the version only appears in a trailing comment. A maintainer following step 2 would also swap a SHA pin for a branch ref, which Renovate would then re-pin. You could update the README to describe the `@<sha> # symlink-keeper-x.y.z` form, including how to point to a dev branch and re-pin after the release tag is created. Or you could exclude this self-reference from Renovate digest pinning.

Verification Rules 3/3 met PRs 2 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 95: Update GitHub actions (major) Inspected
PR 102: Mark intentionally unobserved promises with void operator Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

💡 Quality: symlink-keeper SHA pin breaks README's tag-based dev/release procedure

This PR changes the internal self-reference from @symlink-keeper-1.0.0 to @a7d13cdd… # symlink-keeper-1.0.0. The SHA is correct: it is the commit the annotated tag points to, and the sub-action contents are identical to HEAD. But the README's symlink-keeper section still says the sub-action is "referenced by version tag … (e.g. @symlink-keeper-1.0.0)" and "The tag is what callers pin to in production". Step 2 of its development procedure also tells maintainers to "Update all @symlink-keeper-* references". After this PR, searching for @symlink-keeper- finds nothing, because the version only appears in a trailing comment. A maintainer following step 2 would also swap a SHA pin for a branch ref, which Renovate would then re-pin. You could update the README to describe the @<sha> # symlink-keeper-x.y.z form, including how to point to a dev branch and re-pin after the release tag is created. Or you could exclude this self-reference from Renovate digest pinning.

_{Was this helpful? React with 👍 / 👎}