SONARJAVA-6316 Use semver range updates (not pinning) for SonarSource GitHub Actions

[tomasz-tylenda-sonarsource]

No description provided.

[hashicorp-vault-sonar-prod]

SONARJAVA-6316

[sonar-review-alpha]

Summary

This PR adds a new Renovate configuration rule for SonarSource GitHub Actions to use semver range updates instead of exact version pinning. The change applies the "replace" range strategy to any GitHub Actions from the SonarSource organization, allowing automatic minor and patch version updates while maintaining flexibility rather than locking to specific versions.

What reviewers should know

What to review:

• The config rule targets the correct package pattern (^SonarSource/) and manager (github-actions)
• The rangeStrategy: "replace" setting implements the intended semver range behavior per the ticket title
• Placement in the config is correct — positioned among other manager-specific overrides and before quarterly update rules

Context:

• This is purely a configuration change with no code impact
• The comment in the config clearly explains the intent
• Part of SONARJAVA-6316, which appears to be about standardizing dependency update strategies

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[sonar-review-alpha]

The new rule is mostly correct, but there's a coverage gap worth clarifying before merge.

🗣️ Give feedback

[sonar-review-alpha]

The pattern ^SonarSource/ is a case-sensitive regex. Five workflow files reference sonarsource/gh-action-lt-backlog (lowercase s) — specifically in PullRequestCreated.yml, PullRequestClosed.yml, RequestReview.yml, SubmitReview.yml, and ToggleLockBranch.yml.

Those actions use @v2-style tags and won't be matched by this rule, so they won't receive rangeStrategy: "replace" unless the parent config (quality-jvm-squad) already covers them.

If excluding sonarsource/ is intentional (e.g. the parent config already handles it), add a comment explaining why. If it's an oversight, widen the pattern to cover both casings:

Suggested change

	matchPackagePatterns: [ "^SonarSource/" ],
	matchPackagePatterns: [ "(?i)^sonarsource/" ],

• Mark as noise