BUILD-10450 use gh-action_cache v1 by julien-carsique-sonarsource · Pull Request #216 · SonarSource/ci-github-actions

julien-carsique-sonarsource · 2026-02-17T09:40:34Z

BUILD-10450 use gh-action_cache v1

hashicorp-vault-sonar-prod · 2026-02-17T09:40:47Z

BUILD-10450

sonarqubecloud · 2026-02-17T13:49:29Z

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Updates the repository’s composite actions to use SonarSource/gh-action_cache major version v1, aligning all caching steps on the same major release.

Changes:

Switched SonarSource/gh-action_cache references from @v1.2.1 to @v1 across multiple composite actions.
Kept existing caching keys/paths/conditions unchanged while standardizing the action reference.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
config-pip/action.yml	Updates pip dependency caching step to use `gh-action_cache@v1`.
config-npm/action.yml	Updates NPM dependency caching step to use `gh-action_cache@v1`.
config-maven/action.yml	Updates Maven repository caching step to use `gh-action_cache@v1`.
config-gradle/action.yml	Updates Gradle cache step to use `gh-action_cache@v1`.
code-signing/action.yml	Updates code-signing tools cache step to use `gh-action_cache@v1`.
cache/action.yml	Updates deprecated wrapper action to delegate to `gh-action_cache@v1`.
build-yarn/action.yml	Updates Yarn dependency caching step to use `gh-action_cache@v1`.
build-poetry/action.yml	Updates Poetry cache step to use `gh-action_cache@v1`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-17T13:53:47Z

cache/action.yml

          "Please migrate to using the SonarSource/gh-action_cache action directly."

-    - uses: SonarSource/gh-action_cache@v1.2.1
+    - uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

- uses: SonarSource/gh-action_cache@v1

- uses: SonarSource/gh-action_cache@5c909a0b8eaf0da8228a64a96b86c09f70f9137d # v1

Copilot · 2026-02-17T13:53:48Z

build-yarn/action.yml


    - name: Cache Yarn dependencies
-      uses: SonarSource/gh-action_cache@v1.2.1
+      uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

uses: SonarSource/gh-action_cache@v1

uses: SonarSource/gh-action_cache@f3bd9d9a0e2c4fcbdeb18f0d33bd44a14bcbb157 # v1

Copilot · 2026-02-17T13:53:48Z

build-poetry/action.yml

        host-actions-root: ${{ steps.set-path.outputs.host_actions_root }}
    - name: Cache local Poetry cache
-      uses: SonarSource/gh-action_cache@v1.2.1
+      uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

uses: SonarSource/gh-action_cache@v1

uses: SonarSource/gh-action_cache@d8fef62f62c5ce57a4e2e828534a4f38ebb33e32 # v1

Copilot · 2026-02-17T13:53:48Z

config-pip/action.yml


    - name: Cache pip dependencies
-      uses: SonarSource/gh-action_cache@v1.2.1
+      uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

uses: SonarSource/gh-action_cache@v1

uses: SonarSource/gh-action_cache@3bb181121986b31bb0d5854e379d4c0b04e5a577 # v1

Copilot · 2026-02-17T13:53:49Z

config-npm/action.yml


    - name: Cache NPM dependencies
-      uses: SonarSource/gh-action_cache@v1.2.1
+      uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

uses: SonarSource/gh-action_cache@v1

uses: SonarSource/gh-action_cache@cde4c457175e8800dc303e6d2ee1b90a3b0a4b2f # v1.0.0

Copilot · 2026-02-17T13:53:49Z

config-maven/action.yml


    - name: Cache local Maven repository
-      uses: SonarSource/gh-action_cache@v1.2.1
+      uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

uses: SonarSource/gh-action_cache@v1

uses: SonarSource/gh-action_cache@d0d3a52e4e9747ce226869e6d64a9e6a6c6a79a # v1.x.y

Copilot · 2026-02-17T13:53:49Z

config-gradle/action.yml


    - name: Gradle Cache
-      uses: SonarSource/gh-action_cache@v1.2.1
+      uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

uses: SonarSource/gh-action_cache@v1

uses: SonarSource/gh-action_cache@a86d965f3caba3a099f7d2188ef3c9bbd67af9f1 # v1

Copilot · 2026-02-17T13:53:50Z

code-signing/action.yml


    - name: Cache code signing tools
-      uses: SonarSource/gh-action_cache@v1.2.1
+      uses: SonarSource/gh-action_cache@v1


Using the floating SonarSource/gh-action_cache@v1 tag reduces build reproducibility and increases supply-chain risk, since the referenced code can change without a PR in this repo. Consider pinning to an immutable commit SHA (and optionally keep a comment like # v1.x.y) so updates remain explicit and reviewable.

Suggested change

uses: SonarSource/gh-action_cache@v1

uses: SonarSource/gh-action_cache@3d9f3f5a4a14f0b0e98c0245ce57a4e2e5b0f881 # v1.x.y

This was referenced Feb 17, 2026

BUILD-10450 custom local actions dir SonarSource/gh-action_cache#38

Closed

Use full refs for helper actions to avoid pre-commit issues SonarSource/gh-action_cache#39

Merged

BUILD-10450 use gh-action_cache v1

2a41b42

julien-carsique-sonarsource force-pushed the fix/jcarsique/BUILD-10450-postRun branch from f52b154 to 2a41b42 Compare February 17, 2026 13:47

julien-carsique-sonarsource marked this pull request as ready for review February 17, 2026 13:50

julien-carsique-sonarsource requested a review from a team as a code owner February 17, 2026 13:50

julien-carsique-sonarsource requested review from Copilot and mikolaj-matuszny-ext-sonarsource February 17, 2026 13:50

Copilot started reviewing on behalf of julien-carsique-sonarsource February 17, 2026 13:51 View session

mikolaj-matuszny-ext-sonarsource approved these changes Feb 17, 2026

View reviewed changes

julien-carsique-sonarsource changed the title ~~BUILD-10450 TEST~~ BUILD-10450 use gh-action_cache v1 Feb 17, 2026

julien-carsique-sonarsource merged commit 148774f into master Feb 17, 2026
19 checks passed

julien-carsique-sonarsource deleted the fix/jcarsique/BUILD-10450-postRun branch February 17, 2026 13:51

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BUILD-10450 use gh-action_cache v1#216

BUILD-10450 use gh-action_cache v1#216
julien-carsique-sonarsource merged 1 commit intomasterfrom
fix/jcarsique/BUILD-10450-postRun

julien-carsique-sonarsource commented Feb 17, 2026 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod bot commented Feb 17, 2026 •

edited by atlassian bot

Loading

Uh oh!

sonarqubecloud bot commented Feb 17, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	- uses: SonarSource/gh-action_cache@v1
	- uses: SonarSource/gh-action_cache@5c909a0b8eaf0da8228a64a96b86c09f70f9137d # v1

	uses: SonarSource/gh-action_cache@v1
	uses: SonarSource/gh-action_cache@f3bd9d9a0e2c4fcbdeb18f0d33bd44a14bcbb157 # v1

	uses: SonarSource/gh-action_cache@v1
	uses: SonarSource/gh-action_cache@d8fef62f62c5ce57a4e2e828534a4f38ebb33e32 # v1

	uses: SonarSource/gh-action_cache@v1
	uses: SonarSource/gh-action_cache@3bb181121986b31bb0d5854e379d4c0b04e5a577 # v1

	uses: SonarSource/gh-action_cache@v1
	uses: SonarSource/gh-action_cache@cde4c457175e8800dc303e6d2ee1b90a3b0a4b2f # v1.0.0

	uses: SonarSource/gh-action_cache@v1
	uses: SonarSource/gh-action_cache@d0d3a52e4e9747ce226869e6d64a9e6a6c6a79a # v1.x.y

	uses: SonarSource/gh-action_cache@v1
	uses: SonarSource/gh-action_cache@a86d965f3caba3a099f7d2188ef3c9bbd67af9f1 # v1

	uses: SonarSource/gh-action_cache@v1
	uses: SonarSource/gh-action_cache@3d9f3f5a4a14f0b0e98c0245ce57a4e2e5b0f881 # v1.x.y

Conversation

julien-carsique-sonarsource commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hashicorp-vault-sonar-prod bot commented Feb 17, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 17, 2026

SonarQube reviewer guide

Quality Gate passed

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

julien-carsique-sonarsource commented Feb 17, 2026 •

edited

Loading

hashicorp-vault-sonar-prod bot commented Feb 17, 2026 •

edited by atlassian bot

Loading