[romainbrenguier]

Summary

• Pin all existing SonarSource/core-languages-tooling-public GitHub Action references to a04d15c9fe09880db6870b01875e184ed57ca242, the current master HEAD on November 2, 2026.
• Keep the current tooling behavior stable before RC-354: Expectation update tool improvements core-languages-tooling-public#85 changes ruling artifact uploads to accept SARIF files only.
• This is a protective pin, not adoption of the new artifact format. Analyzers can migrate separately and update their ruling actions together when ready.

Validation

• git diff --check passes.
• Automated comparison confirms that only action versions change (and an outdated snapshot-date comment is removed where applicable).
• Analyzer builds and ruling tests are not run: no analyzer code or artifact-upload behavior changes in this PR.

[hashicorp-vault-sonar-prod]

RC-354

[gitar-bot]

Code Review 👍 Approved with suggestions 0 closed / 1 findings

🟡 Medium risk · Pinning shared CI actions to a new commit could change artifact preparation, ruling updates, or notifications and disrupt build workflows.

Pins all SonarSource/core-languages-tooling-public action references to commit a04d15c9, protecting analyzer ruling workflows from the upcoming SARIF-only artifact change in PR #85. Open suggestion: the pin is shallow, since the pinned ruling-update-and-notify and pvf-trigger composite actions still call sibling actions via @master (in ruling-diff-comment and pvf-comment), so the PR description should note the pin is partial or those nested references should be pinned upstream.

💡 Edge Case: Pin is shallow: pinned actions still call sibling actions @master

📄 .github/workflows/build.yml:194 📄 .github/workflows/pvf-comment.yml:34

The SHA pin only freezes the top-level action files. At a04d15c, ruling-update-and-notify/action.yml (line 137) calls SonarSource/core-languages-tooling-public/ruling-diff-comment@master, and pvf-trigger/action.yml (line 53) calls pvf-comment@master. Those nested steps keep resolving against the live master. That means the Update ruling and notify job in build.yml and the PVF trigger in pvf-comment.yml can still change behavior when upstream changes, which contradicts the PR's goal of keeping tooling behavior stable. PR #85 doesn't touch ruling-diff-comment or pvf-comment (see its file list), so the SARIF change itself is covered. Any later change to those two nested actions is not. To get a full pin, the upstream composite actions would need to reference their siblings through ${{ github.action_path }}-relative local paths or pinned SHAs. Otherwise, the PR description should say this pin is partial.

🤖 Prompt for agents

Code Review: Pins all `SonarSource/core-languages-tooling-public` action references to commit `a04d15c9`, protecting analyzer ruling workflows from the upcoming SARIF-only artifact change in PR #85. Open suggestion: the pin is shallow, since the pinned `ruling-update-and-notify` and `pvf-trigger` composite actions still call sibling actions via `@master` (in `ruling-diff-comment` and `pvf-comment`), so the PR description should note the pin is partial or those nested references should be pinned upstream.

1. 💡 Edge Case: Pin is shallow: pinned actions still call sibling actions @master
   Files: .github/workflows/build.yml:194, .github/workflows/pvf-comment.yml:34

   The SHA pin only freezes the top-level action files. At `a04d15c`, [`ruling-update-and-notify/action.yml`](https://raw.githubusercontent.com/SonarSource/core-languages-tooling-public/a04d15c9fe09880db6870b01875e184ed57ca242/ruling-update-and-notify/action.yml) (line 137) calls `SonarSource/core-languages-tooling-public/ruling-diff-comment@master`, and [`pvf-trigger/action.yml`](https://raw.githubusercontent.com/SonarSource/core-languages-tooling-public/a04d15c9fe09880db6870b01875e184ed57ca242/pvf-trigger/action.yml) (line 53) calls `pvf-comment@master`. Those nested steps keep resolving against the live `master`. That means the `Update ruling and notify` job in build.yml and the PVF trigger in pvf-comment.yml can still change behavior when upstream changes, which contradicts the PR's goal of keeping tooling behavior stable. PR #85 doesn't touch `ruling-diff-comment` or `pvf-comment` (see its [file list](https://api.github.com/repos/SonarSource/core-languages-tooling-public/pulls/85/files?per_page=5&page=1)), so the SARIF change itself is covered. Any later change to those two nested actions is not. To get a full pin, the upstream composite actions would need to reference their siblings through `${{ github.action_path }}`-relative local paths or pinned SHAs. Otherwise, the PR description should say this pin is partial.

Verification Rules 2/3 met PRs 4 inspected

Rules 1 failed 2 passed

❌ Approved GitHub Actions runners (approved_runners) - Repo workflows still use retired sonar-xs-public labels (e.g. build.yml:484, ToggleLockBranch.yml, releasability.yaml); migrate to sonar-xs, or github-ubuntu-latest-s for release/releasability jobs, per the runners policy.
✅ Internal artifact registries (artifactory_registries)
✅ Repository license compliance (license_compliance)

Functional validation No results

Broader impact PRs 4 inspected

Cross-PR 4 PRs inspected 0 open impacts

PR 85: RC-354: Expectation update tool improvements Inspected
PR 6445: RC-451 Migrate Java ruling expectations to SARIF Inspected
PR 6418: RC-353 Test Sarif diff Inspected
PR 6429: Test ruling-diff action across all ruling projects Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

💡 Edge Case: Pin is shallow: pinned actions still call sibling actions @master

The SHA pin only freezes the top-level action files. At a04d15c, ruling-update-and-notify/action.yml (line 137) calls SonarSource/core-languages-tooling-public/ruling-diff-comment@master, and pvf-trigger/action.yml (line 53) calls pvf-comment@master. Those nested steps keep resolving against the live master. That means the Update ruling and notify job in build.yml and the PVF trigger in pvf-comment.yml can still change behavior when upstream changes, which contradicts the PR's goal of keeping tooling behavior stable. PR #85 doesn't touch ruling-diff-comment or pvf-comment (see its file list), so the SARIF change itself is covered. Any later change to those two nested actions is not. To get a full pin, the upstream composite actions would need to reference their siblings through ${{ github.action_path }}-relative local paths or pinned SHAs. Otherwise, the PR description should say this pin is partial.

_{Was this helpful? React with 👍 / 👎}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube