From fda174d05ffcfee44428210ea38dd4b7b2dac538 Mon Sep 17 00:00:00 2001 From: Javi Aguilar <122741+itsjavi@users.noreply.github.com> Date: Tue, 13 Oct 2026 10:31:43 +0200 Subject: [PATCH 1/3] ci: stop Dependabot proposing sonarqube-scan-action v8 The workflow holds the action at v6.0.0 because v8 verifies the scanner against SonarSource's GPG key from keyservers this macOS runner cannot reach, which fails the scan. Dependabot proposed v8 anyway (#61, #65) and #61 was merged, breaking the Sonar step until it was reverted. Ignoring major updates keeps the pin; v6 minor and patch releases still come through. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0110699..ea9fd7f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,3 +21,9 @@ updates: github-actions: patterns: - "*" + ignore: + # Held at v6.0.0: v8 fetches SonarSource's GPG key from keyservers this macOS runner + # cannot reach, which fails every scan. See the comment on the pin in + # .github/workflows/sonarqube.yml. Minor and patch releases of v6 still come through. + - dependency-name: SonarSource/sonarqube-scan-action + update-types: ["version-update:semver-major"] From d400011636cce54d99526942c8f1e486dd488487 Mon Sep 17 00:00:00 2001 From: Javi Aguilar <122741+itsjavi@users.noreply.github.com> Date: Tue, 13 Oct 2026 15:55:56 +0200 Subject: [PATCH 2/3] chore: retrigger license check From 2057f7bd1064186a3e58f6b4efc922b460e459c9 Mon Sep 17 00:00:00 2001 From: Anshuman Pandey <54475686+pandeymangg@users.noreply.github.com> Date: Tue, 13 Oct 2026 19:28:45 +0530 Subject: [PATCH 3/3] chore: retrigger CI