chore(deps): update sonarsource/sonarqube-scan-action action to v8

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
sonarsource/sonarqube-scan-action	action	major	v7.2 → v8.0

---

Release Notes

sonarsource/sonarqube-scan-action (sonarsource/sonarqube-scan-action)

v8

Compare Source

v8.0

Compare Source

v8.0.0

Compare Source

What's Changed

Breaking change

• SQSCANGHA-145 Set skipSignatureVerification default value to false by @​antoine-vinot-sonarsource in SonarSource#241

Full Changelog: SonarSource/sonarqube-scan-action@v7...v8.0.0

v7.2.1

Compare Source

What's Changed

• SQSCANGHA-140 Set skipSignatureVerification default value to true to avoid breaking change by @​gmmcal in SonarSource#240

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.2.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/build.yml">

<violation number="1" location=".github/workflows/build.yml:86">
P2: This major-version bump changes `skipSignatureVerification` behavior implicitly. Set it explicitly in the workflow so the pipeline doesn't silently change behavior on upgrade.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: This major-version bump changes skipSignatureVerification behavior implicitly. Set it explicitly in the workflow so the pipeline doesn't silently change behavior on upgrade.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/build.yml, line 86:

<comment>This major-version bump changes `skipSignatureVerification` behavior implicitly. Set it explicitly in the workflow so the pipeline doesn't silently change behavior on upgrade.</comment>

<file context>
@@ -83,7 +83,7 @@ jobs:
       - name: Run Tests
         run: bun run coverage
-      - uses: sonarsource/sonarqube-scan-action@v7.2
+      - uses: sonarsource/sonarqube-scan-action@v8.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
</file context>

Suggested change

	- uses: sonarsource/sonarqube-scan-action@v8.0
	- uses: sonarsource/sonarqube-scan-action@v8.0
	with:
	skipSignatureVerification: true

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud