.github/workflows/it-test.yml

@@ -9,7 +9,7 @@ jobs:
     name: "IT Test - default inputs values should work fine on this repo"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Given the gh-action is used with default values
         id: test-data
         uses: ./
@@ -24,7 +24,7 @@ jobs:
     name: "IT Test - custom extra-args should be honored"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Given the gh-action is used with extra-args=--help
         id: test-data
         uses: ./
@@ -41,7 +41,7 @@ jobs:
     name: "IT Test - output status should be 1 given pre-commit detected some issue"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Given a pre-commit-config not correctly respected
         id: test-data
         uses: ./
@@ -60,7 +60,7 @@ jobs:
     name: "IT Test - output status should be 0 given pre-commit detected no issue"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Given a pre-commit-config correctly respected
         id: test-data
         uses: ./
@@ -79,7 +79,7 @@ jobs:
     name: "IT Test - output logs should contain failures given pre-commit detected some issue"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Given a pre-commit-config not correctly respected
         id: test-data
         uses: ./
@@ -98,7 +98,7 @@ jobs:
     name: "IT Test - output logs should contain no failure given pre-commit detected no issue"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Given a pre-commit-config correctly respected
         id: test-data
         uses: ./

.github/workflows/pre-commit.yml

@@ -6,7 +6,7 @@ jobs:
     name: "pre-commit"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - uses: ./
         with:
           extra-args: >

SECURITY.md

@@ -0,0 +1,19 @@
+# Reporting Security Issues
+
+A mature software vulnerability treatment process is a cornerstone of a robust information security management system.
+Contributions from the community play an important role in the evolution and security of our products, and in safeguarding
+the security and privacy of our users.
+
+If you believe you have discovered a security vulnerability in Sonar's products, we encourage you to report it immediately.
+
+To responsibly report a security issue, please email us at [security@sonarsource.com](mailto:security@sonarsource.com).
+Sonar’s security team will acknowledge your report, guide you through the next steps,
+or request additional information if necessary.
+Customers with a support contract can also report the vulnerability directly through the support channel.
+
+For security vulnerabilities found in third-party libraries, please also contact the library's owner or maintainer directly.
+
+## Responsible Disclosure Policy
+
+For more information about disclosing a security vulnerability to Sonar, please refer to our community post:
+[Responsible Vulnerability Disclosure](https://community.sonarsource.com/t/responsible-vulnerability-disclosure/9317/).

action.yml

@@ -25,7 +25,7 @@ runs:
   using: composite
   steps:
     - name: Checkout
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
     - name: Fetch origin
       run: git fetch origin # avoid unknown revision or path not in the working tree when
       # using --from-ref --to-ref feature of pre-commit