SQSCANGHA-126 Update SonarScanner CLI to 8.0.1.6346 (#218 )

SQSCANGHA-123 NO-JIRA Bump actions/setup-node from 5 to 6 (#214 )
SQSCANGHA-122 Include caveats for running SCA (#213 )
2025-12-13 18:01:15 +00:00 · 2025-12-09 09:53:51 +01:00 · 2025-10-15 15:09:18 +02:00 · 2025-10-09 06:21:35 -05:00 · 2025-10-06 09:29:17 +02:00 · 2025-09-22 07:47:48 +02:00
6 changed files with 25 additions and 16 deletions
--- a/.github/workflows/qa-deprecated-c-cpp.yml
+++ b/.github/workflows/qa-deprecated-c-cpp.yml
@ -11,13 +11,16 @@ jobs:
  output-test:
    name: Action outputs
    strategy:
+      fail-fast: false
      matrix:
-        os: [github-ubuntu-latest-s, github-windows-latest-s, macos-latest, macos-13]
+        os: [github-ubuntu-latest-s, github-windows-latest-s, macos-latest, macos-14]
        cache: [true, false]
        include:
          - arch: X64
          - os: macos-latest
            arch: ARM64
+          - os: macos-14
+            arch: ARM64
    runs-on: ${{ matrix.os }}
    steps:
      # Specifying a specific architecture of the runner is not possible for Github hosted runners
--- a/.github/workflows/qa-install-build-wrapper.yml
+++ b/.github/workflows/qa-install-build-wrapper.yml
@ -11,13 +11,16 @@ jobs:
  output-test:
    name: Action outputs
    strategy:
+      fail-fast: false
      matrix:
-        os: [github-ubuntu-latest-s, github-windows-latest-s, macos-latest, macos-13]
+        os: [github-ubuntu-latest-s, github-windows-latest-s, macos-latest, macos-14]
        cache: [true, false]
        include:
          - arch: X64
          - os: macos-latest
            arch: ARM64
+          - os: macos-14
+            arch: ARM64
    runs-on: ${{ matrix.os }}
    steps:
      # Specifying a specific architecture of the runner is not possible for Github hosted runners
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@ -13,7 +13,7 @@ jobs:
      - uses: actions/checkout@v5

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "npm"
--- a/README.md
+++ b/README.md
@ -89,10 +89,13 @@ This GitHub Action will not work for all technologies. If you are in one of the
 * **Your code is built with Gradle**. Read the documentation about our SonarScanner for Gradle in SonarQube [Server](https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/sonarscanner-for-gradle/) and [Cloud](https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/ci-based-analysis/sonarscanner-for-gradle/).
 * **You want to analyze a .NET solution**. Read the documentation about our SonarScanner for .NET in SonarQube [Server](https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/scanners/dotnet/introduction/) and [Cloud](https://docs.sonarsource.com/sonarqube-cloud/advanced-setup/ci-based-analysis/sonarscanner-for-dotnet/introduction/).

-**Also, do not use this GitHub action if:**
+**Do not use this GitHub action if:**

 * You want to run the action on C, C++, or Objective-C projects on a 32-bits system - build wrappers support only 64-bits OS.

+**If you want to use Software Composition Analysis (SCA)**
+
+Dependency scanning with SonarQube Advanced Security SCA may not work correctly if scanning requires on-the-fly manifest file generation. See the SCA analysis environment requirement documentation for [Cloud](https://docs.sonarsource.com/sonarqube-cloud/advanced-security/analyzing-projects-for-dependencies-sca#appropriate-environment) or [Server](https://docs.sonarsource.com/sonarqube-server/advanced-security/analyzing-projects-for-dependencies#appropriate-environment).

 ## Key requirements

--- a/action.yml
+++ b/action.yml
@ -19,7 +19,7 @@ inputs:
    description: Version of the Sonar Scanner CLI to use
    required: false
    # to be kept in sync with sonar-scanner-version
-    default: 7.2.0.5079
+    default: 8.0.1.6346
  scannerBinariesUrl:
    description: URL to download the Sonar Scanner CLI binaries from
    required: false
--- a/22
+++ b/22
@ -1,11 +1,11 @@
-sonar-scanner-version=7.2.0.5079
-sonar-scanner-url-windows-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-windows-x64.zip
-sonar-scanner-sha-windows-x64=71936f352206b63cb05ffbcd68e366e52d22916148cf4a2418789bc776f733ea
-sonar-scanner-url-linux-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-linux-x64.zip
-sonar-scanner-sha-linux-x64=da9f4e64a3d555f08ce38b5469ebd91fe2b311af473f7001a5ee5c1fd58b004b
-sonar-scanner-url-linux-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-linux-aarch64.zip
-sonar-scanner-sha-linux-aarch64=803ca725d463e95eeb7537515706367bb8e52bf05ac32174daf9773bdb36d1e2
-sonar-scanner-url-macosx-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-macosx-x64.zip
-sonar-scanner-sha-macosx-x64=7b9e92248ca740fff41503bfe5459c460bac43c501d80043cc4fbebb72dfc5fa
-sonar-scanner-url-macosx-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-7.2.0.5079-macosx-aarch64.zip
-sonar-scanner-sha-macosx-aarch64=c8adb3fbfe5485c17de193a217be765b66cbc10d6540057655afa3c3b5be6f61
+sonar-scanner-version=8.0.1.6346
+sonar-scanner-url-windows-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.0.1.6346-windows-x64.zip
+sonar-scanner-sha-windows-x64=52b35b24be4ce5ec2e2933b32683db45db139581c46945546d9739b0c8866231
+sonar-scanner-url-linux-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.0.1.6346-linux-x64.zip
+sonar-scanner-sha-linux-x64=4bd40bf8411ed104853e94a3746ec92bc92845fde2b27dbf5c33fb5cfa8ecbe9
+sonar-scanner-url-linux-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.0.1.6346-linux-aarch64.zip
+sonar-scanner-sha-linux-aarch64=ae2b062ed6d640ab9014ab576042385d54c910857de952f5cb2592d2a2d7c8d8
+sonar-scanner-url-macosx-x64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.0.1.6346-macosx-x64.zip
+sonar-scanner-sha-macosx-x64=aa9065347ba834ff6f3d461183eb40a67a321e6996206875fd257e8e7d5745b2
+sonar-scanner-url-macosx-aarch64=https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.0.1.6346-macosx-aarch64.zip
+sonar-scanner-sha-macosx-aarch64=2d65d49c327ec8ca5ec7c6dc2af17749f5b43c596fd906501bba5a0b09edc5e2
Author	SHA1	Message	Date
github-actions[bot]	a31c9398be	SQSCANGHA-126 Update SonarScanner CLI to 8.0.1.6346 (#218 ) Some checks failed QA Deprecated C and C++ action / Action outputs (push) Has been cancelled Details Unit tests / test (push) Has been cancelled Details QA Install Build Wrapper action / Action outputs (push) Has been cancelled Details QA Main action / No inputs (push) Has been cancelled Details QA Main action / 'args' input (push) Has been cancelled Details QA Main action / 'args' input with command injection will fail (push) Has been cancelled Details QA Main action / 'args' input with backticks injection does not execute command (push) Has been cancelled Details QA Main action / 'args' input with dollar command injection does not execute command (push) Has been cancelled Details QA Main action / 'args' input with other command injection variants does not execute command (push) Has been cancelled Details QA Main action / 'projectBaseDir' input (push) Has been cancelled Details QA Main action / 'scannerVersion' input (push) Has been cancelled Details QA Main action / 'scannerBinariesUrl' input with invalid URL (push) Has been cancelled Details QA Main action / 'scannerBinariesUrl' is escaped with wget so special chars are not injected in the download command (push) Has been cancelled Details QA Main action / 'scannerBinariesUrl' is escaped with curl so special chars are not injected in the download command (push) Has been cancelled Details QA Main action / Don't fail on Gradle project (push) Has been cancelled Details QA Main action / Don't fail on Kotlin Gradle project (push) Has been cancelled Details QA Main action / Don't fail on Maven project (push) Has been cancelled Details QA Main action / runAnalysisTest (push) Has been cancelled Details QA Main action / 'RUNNER_DEBUG' is used (push) Has been cancelled Details QA Main action / runAnalysisWithCacheTest (push) Has been cancelled Details QA Main action / 'SONARCLOUD_URL' is used (push) Has been cancelled Details QA Main action / curl performs redirect when scannerBinariesUrl returns 3xx (push) Has been cancelled Details QA Main action / 'SONAR_ROOT_CERT' is converted to truststore (push) Has been cancelled Details QA Main action / Analysis takes into account 'SONAR_ROOT_CERT' (push) Has been cancelled Details QA Main action / truststore.p12 is updated when present (push) Has been cancelled Details QA Main action / 'scannerVersion' input validation (push) Has been cancelled Details QA Scripts / create_install_path.sh (push) Has been cancelled Details QA Scripts / configure_paths.sh (push) Has been cancelled Details QA Scripts / download.sh (push) Has been cancelled Details QA Scripts / fetch_latest_version.sh (push) Has been cancelled Details	2025-12-09 09:53:51 +01:00
dependabot[bot]	40f5b61913	SQSCANGHA-123 NO-JIRA Bump actions/setup-node from 5 to 6 (#214 )	2025-10-15 15:09:18 +02:00
Brandon Davis	9bf7c126a1	SQSCANGHA-122 Include caveats for running SCA (#213 )	2025-10-09 06:21:35 -05:00
github-actions[bot]	ba6563cca7	Update SonarScanner CLI to 7.3.0.5189 (#212 )	2025-10-06 09:29:17 +02:00
dependabot[bot]	5ffbad4454	SQSCANGHA-120 Bump actions/setup-node from 4 to 5 (#211 )	2025-09-22 07:47:48 +02:00