ECHOES-1418 [renovate] Update GitHub Actions dependencies to v7 by renovate[bot] · Pull Request #724 · SonarSource/echoes-react

renovate · 2026-07-03T15:20:21Z

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/gh-action_release	action	major	`v6` → `7.4.0`
actions/checkout	action	major	`v6.0.2` → `v7.0.0`

Release Notes

SonarSource/gh-action_release (SonarSource/gh-action_release)

`v7.4.0`

Compare Source

What's Changed

Improvements

BUILD-11518 Migrate Slack failure notifications to slackapi/slack-github-action v3.0.3 (Node 24 compliant) by @SamirM-BE in #404

Full Changelog: SonarSource/gh-action_release@7.3.0...7.4.0

`v7.3.0`

Compare Source

🚀 gh-action_release 7.3.0 (v7 branch updated) 🚀

✨ What's New

SBOMs co-located with binaries — every release artifact's CycloneDX SBOM is now uploaded next to the binary on binaries.sonarsource.com (with .md5/.sha1/.sha256 and .asc when present), automatically and with no per-project config (BUILD-10272, #403)
Option to require a pre-created draft release (createDraftRelease: false) (BUILD-11271, #395)
GitHub job summary with the release notes and next steps after a release run (BUILD-11274, #396)

⚡ Improvements

Node 24 across the reusable and internal workflows; jfrog-setup-wrapper pinned to 3.7.0 (BUILD-10781, #401, #402)
Manual Maven Central re-sync script and named CI deployments (BUILD-11469, #400)
Draft-first v7 release flow refinements / simplified self-reference release script (BUILD-11106, #393, #394)

New Contributors

@hatem-amairi-sonarsource made their first contribution in #395

Full Changelog: SonarSource/gh-action_release@6.8.1...7.3.0

`v7.2.0`

Compare Source

What's Changed

Improvements

BUILD-10781 Bump jfrog-setup-wrapper pin to 3.7.0 by @jayadeep-km-sonarsource in #402

Full Changelog: SonarSource/gh-action_release@7.1.0...7.2.0

`v7.1.0`

Compare Source

What's Changed

New Features

BUILD-11271 Add option to require pre-created draft release by @hatem-amairi-sonarsource in #395
BUILD-11274 Add GitHub summary with release notes and next steps by @julien-carsique-sonarsource in #396
BUILD-11106 Draft-first v7 release flow (workflow_dispatch) by @SamirM-BE in #393

Improvements

BUILD-11106 Simplify self-reference release script by @julien-carsique-sonarsource in #394
BUILD-10781 Bump JS deps in reusable + internal workflows to Node 24 by @jayadeep-km-sonarsource in #401

New Contributors

@hatem-amairi-sonarsource made their first contribution in #395

Full Changelog: SonarSource/gh-action_release@6.8.1...7.1.0

`v7.0.1`

Compare Source

What's Changed

New Features

BUILD-11271 Add option to require pre-created draft release by @hatem-amairi-sonarsource in #395

New Contributors

@hatem-amairi-sonarsource made their first contribution in #395

Full Changelog: SonarSource/gh-action_release@7.0.0...7.0.1

`v7.0.0`

Compare Source

What's Changed

The v7 generation complies with release and tag immutability.

Improvements

BUILD-11106 Draft-first v7 release flow (workflow_dispatch) by @SamirM-BE in #393
BUILD-11106 Simplify self-reference release script by @julien-carsique-sonarsource in #394

Breaking Change

version input is now required
the action must not be triggered by the release published event: the action now owns the GitHub release publication (existing draft will be reused). See https://github.com/SonarSource/gh-action_release/tree/7.0.0#migrating-from-v6-to-v7-draft-first-workflow_dispatch for more details and migration steps.

Full Changelog: SonarSource/gh-action_release@6.8.1...7.0.0

actions/checkout (actions/checkout)

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

Configuration

📅 Schedule: (in timezone CET)

Branch creation
- Between 12:00 AM and 02:59 AM (* 0-2 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

If the PR is green: it means that the dependencies have been update successfully; double check the changelog and merge! When merging don't forget to squash the commit and add prefix the commit message witht the JIRA tickets that has been automatically created.
If the PR is red: something went wrong; double check the changelog and then either:
- Fix the issues if the breaking changes are quick to fix or you have the time for it: make sure to add a new commit and not to modify the one from the Renovate
- If the required changes are too big: create a JIRA ticket and assign it to the FEE squad, finally update the rennovate.json file to ignore the dependency and document the reason why it has been ignored, the Renovate PR can be closed.

To know more about the whole process, check our WebApp dependencies management xtranet page.

netlify · 2026-07-03T15:20:27Z

✅ Deploy Preview for echoes-react ready!

Name	Link
🔨 Latest commit	`90c1ab0`
🔍 Latest deploy log	https://app.netlify.com/projects/echoes-react/deploys/6a47d5481a605f000898b37a
😎 Deploy Preview	https://deploy-preview-724--echoes-react.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

hashicorp-vault-sonar-prod · 2026-07-03T15:20:48Z

Renovate Jira issue ID: ECHOES-1418

sonarqube-next · 2026-07-03T15:32:33Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

renovate Bot added the renovate-dependencies label Jul 3, 2026

renovate Bot requested a review from gregaubert July 3, 2026 15:20

[renovate] Update GitHub Actions dependencies to v7

90c1ab0

renovate Bot force-pushed the renovate/major-7-github-actions-dependencies branch from aff079d to 90c1ab0 Compare July 3, 2026 15:29

gregaubert approved these changes Jul 3, 2026

View reviewed changes

gregaubert changed the title ~~[renovate] Update GitHub Actions dependencies to v7~~ ECHOES-1418 [renovate] Update GitHub Actions dependencies to v7 Jul 3, 2026

gregaubert merged commit 62c046a into main Jul 3, 2026
11 checks passed

gregaubert deleted the renovate/major-7-github-actions-dependencies branch July 3, 2026 15:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ECHOES-1418 [renovate] Update GitHub Actions dependencies to v7#724

ECHOES-1418 [renovate] Update GitHub Actions dependencies to v7#724
gregaubert merged 1 commit into
mainfrom
renovate/major-7-github-actions-dependencies

renovate Bot commented Jul 3, 2026

Uh oh!

netlify Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jul 3, 2026 •

edited by atlassian Bot

Loading

Uh oh!

sonarqube-next Bot commented Jul 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jul 3, 2026

Release Notes

What's Changed

Improvements

✨ What's New

⚡ Improvements

New Contributors

What's Changed

Improvements

What's Changed

New Features

Improvements

New Contributors

What's Changed

New Features

New Contributors

What's Changed

Improvements

Configuration

Uh oh!

netlify Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for echoes-react ready!

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jul 3, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqube-next Bot commented Jul 3, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

netlify Bot commented Jul 3, 2026 •

edited

Loading

hashicorp-vault-sonar-prod Bot commented Jul 3, 2026 •

edited by atlassian Bot

Loading