[tomverin]

Summary

Pin .github/workflows/test.yml from jdx/mise-action v4.0.1 to step-security/mise-action v4.0.1 (c7396e2a2a4ad1ea43abee3317d964292da354ae). Same version as the other v4 pins and mise-action-wrapper. Published action files are unchanged.

https://sonarsource.atlassian.net/browse/BUILD-13190

Test plan

Fully tested.

Public CI on this pull request does not prove the StepSecurity subscription check. A public log prints Free for public repositories, which means the private subscription call was skipped.

Private subscription smoke of this SHA (c7396e2a), on private sonar-dummy-yarn, green:

https://github.com/SonarSource/sonar-dummy-yarn/actions/runs/39930369963

That run printed StepSecurity Maintained Action and did not print Free for public repositories, This action requires a StepSecurity subscription, or Timeout or API not reachable.

The earlier smoke of v4.2.4 (https://github.com/SonarSource/sonar-dummy/actions/runs/39930048152) is not the pin in this pull request.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Switching the test workflow to StepSecurity's action changes the external setup dependency; its implementation is outside the diff, leaving CI behavior uncertain.

Pins .github/workflows/test.yml to step-security/mise-action v4.0.1 (c7396e2a2a4ad1ea43abee3317d964292da354ae), matching the other v4 pins. The earlier PR description reference to v4.2.4 was resolved: the description no longer claims that pin, and the private subscription smoke for this SHA on sonar-dummy-yarn printed StepSecurity Maintained Action. No open issues remain.

✅ 1 closed

✅ Quality: PR description and test evidence still refer to v4.2.4, not the pinned v4.0.1

📄 .github/workflows/test.yml:21
The latest commit switches the pin from step-security/mise-action@6e96d2ff… # v4.2.4 to @c7396e2a… # v4.0.1. The SHA does match the step-security v4.0.1 release. The PR description, though, still says the workflow is pinned to v4.2.4 (6e96d2ffbc65c037f23c78818f2a339d6cf830f7). Its "same SHA" private smoke run on sonar-dummy tested that v4.2.4 commit. So nothing has checked that the merged SHA c7396e2… passes the StepSecurity subscription check on a private repo. Public CI skips that check (Free for public repositories). Either update the description and rerun the private smoke test against c7396e2…, or go back to the v4.2.4 pin that was tested.

Verification Rules 3/3 met PRs 2 inspected

Functional validation No results

Rules 3 passed

✅ Approved GitHub Actions runners
✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 16: BUILD-13186: Pin third-party actions to StepSecurity Inspected
PR 103: BUILD-13187: Pin test workflows to StepSecurity Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}