Update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/ci-github-actions (changelog)	action	digest	d41706a → 2120607
SonarSource/gh-action_release	workflow	minor	7.5.0 → 7.7.0
SonarSource/release-github-actions	action	patch	1.9.13 → 1.9.15
SonarSource/release-github-actions	workflow	patch	1.9.13 → 1.9.15
SonarSource/vault-action-wrapper	action	minor	3.6.1 → 3.7.0
sonarsource/gh-action-lt-backlog	action	pinDigest	→ 63ab0d7

---

Release Notes

SonarSource/gh-action_release (SonarSource/gh-action_release)

v7.7.0

Compare Source

What's Changed

New Features

• Maven Central publishes are now validated against the Central Portal before the Repox promote step, and the same validated deployment is published after promotion succeeds — no double upload, no split-brain between Repox and Central. A Central rejection now aborts the release before anything is promoted; a post-promotion publish failure no longer reverts the Repox promotion, it fails loudly with manual recovery instructions instead. download_artifacts_for_central() also walks each published artifact's own <parent> chain and fetches every public ancestor's pom, so an aggregator/root pom (never itself listed in artifactsToPublish) still reaches the bundle. (#​416, BUILD-12538)
• Javadoc publication now supports mixed-privacy releases (one build producing both org.sonarsource.* and com.sonarsource.* artifacts): both tiers are attempted, and the existing publicRelease flag decides whether to publish just the public half or both when a release is genuinely mixed. Single-privacy repos are unaffected — publicRelease only matters once a repo actually becomes mixed-privacy, no config migration needed. download-build gained a new fail-no-op input (default true, preserving existing behavior for every current caller) so a tolerated empty tier isn't confused with a real download error. (#​420, BUILD-12556)

Bug Fixes

• Guard against a same-named javadoc jar in one privacy tier silently overwriting the other tier's already-copied jar in the destination directory; a collision is now skipped with a logged warning instead. (#​421, BUILD-12556)

Full Changelog: SonarSource/gh-action_release@7.6.0...7.7.0

v7.6.0

Compare Source

What's Changed

New Features

• Add support for publishing Rust crates to crates.io via publishToCratesIo, backed by a Vault-sourced CARGO_REGISTRY_TOKEN. The job runs cargo publish --dry-run before the real publish so a crate that doesn't package or build standalone fails before it ships, and an already-published version is detected and skipped rather than retried (crates.io refuses duplicates, so this also makes a release re-run safe). See Publishing to crates.io for the single-crate-repo requirement, Cargo.toml prerequisites, and the additional Vault permission needed. With @​saberduck (Tibor Blenessy). (#​413, BUILD-12231)

Full Changelog: SonarSource/gh-action_release@7.5.0...7.6.0

SonarSource/release-github-actions (SonarSource/release-github-actions)

v1.9.15

Compare Source

What's Changed

• CPP-9067 Support SQS release branches in automated releases by @​mostafa-mohammed-sonarsource in #​208
• CPP-9066 Validate releasability on the selected release branch by @​mostafa-mohammed-sonarsource in #​207
• ACOMMONS-157 Prefer repo-specific repox status in get-release-version by @​daniel-teuchert-sonarsource in #​204

New Contributors

• @​mostafa-mohammed-sonarsource made their first contribution in #​208
• @​daniel-teuchert-sonarsource made their first contribution in #​204

Full Changelog: SonarSource/release-github-actions@1.9.14...1.9.15

v1.9.14

Compare Source

What's Changed

• GHA-289 SONAR tickets have the "Edition", "Team" fields filled in by @​jonas-wielage-sonarsource in #​206

Full Changelog: SonarSource/release-github-actions@1.9.13...1.9.14

SonarSource/vault-action-wrapper (SonarSource/vault-action-wrapper)

v3.7.0

Compare Source

What's new

• PREQ-8637: Allow workflows with issue_comment trigger to use Vault by @​matemoln in #​83 and SonarSource/re-terraform-aws-vault#9677

Full Changelog: SonarSource/vault-action-wrapper@3.6.1...3.7.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At 08:00 PM through 11:59 PM and 12:00 AM through 07:59 AM, Monday through Friday (* 20-23,0-7 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for sonarqube-cli canceled.

Name	Link
🔨 Latest commit	28cf297
🔍 Latest deploy log	https://app.netlify.com/projects/sonarqube-cli/deploys/6aad3ba4f9409f0008f9d7af

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: CLI-1099

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud