[mary-georgiou]

CLP-1075

Bumps all SonarSource/ci-github-actions/*@v1 references to @v2:

• .github/workflows/pr-cleanup.yml:11 — pr_cleanup@v1 -> @v2
• .github/workflows/build.yml:46 — build-maven@v1 -> @v2
• .github/workflows/build.yml:92 — code-signing@v1 -> @v2
• .github/workflows/build.yml:284 — promote@v1 -> @v2
• .github/workflows/build.yml:354 — promote@v1 -> @v2

🤖 Generated with Claude Code

[hashicorp-vault-sonar-prod]

CLP-1075

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[guillaume-dequenne]

LGTM

[gitar-bot]

Code Review 👍 Approved with suggestions 0 closed / 1 findings

🟡 Medium risk · CI workflows switch build, signing, and promotion actions to v2; their implementations are unseen.

Bumps all SonarSource/ci-github-actions/* references from @v1 to @v2 across five workflow steps. A comment at .github/workflows/build.yml:264 still references promote@v1 and should be updated to @v2 for consistency.

💡 Quality: Comment still says promote@v1 after the bump to v2

📄 .github/workflows/build.yml:264

This PR moves every SonarSource/ci-github-actions/* reference to @v2, including the promote-npm job at line 354. The comment in the npm deploy step (line 264) still says the job uses ci-github-actions/promote@v1. The workflow runs the same either way, but anyone reading that comment to understand the buildInfo.env contract (ARTIFACTORY_DEPLOY_REPO/PROJECT_VERSION) is pointed at the wrong major version. Update the comment to say @v2.

Change the comment to match the new action version.

# The promote-npm job (ci-github-actions/promote@v2) reads these from the build-info to derive the

🤖 Prompt for agents

Code Review: Bumps all `SonarSource/ci-github-actions/*` references from `@v1` to `@v2` across five workflow steps. A comment at `.github/workflows/build.yml:264` still references `promote@v1` and should be updated to `@v2` for consistency.

1. 💡 Quality: Comment still says promote@v1 after the bump to v2
   Files: .github/workflows/build.yml:264

   This PR moves every `SonarSource/ci-github-actions/*` reference to `@v2`, including the `promote-npm` job at line 354. The comment in the npm deploy step (line 264) still says the job uses `ci-github-actions/promote@v1`. The workflow runs the same either way, but anyone reading that comment to understand the buildInfo.env contract (ARTIFACTORY_DEPLOY_REPO/PROJECT_VERSION) is pointed at the wrong major version. Update the comment to say `@v2`.

   Fix (Change the comment to match the new action version.):
   # The promote-npm job (ci-github-actions/promote@v2) reads these from the build-info to derive the

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}