Release/3.6.2

[wzieba]

---

• I have considered if this change warrants release notes and have added them to the appropriate section in the CHANGELOG.md if necessary.

[AliSoftware]

I'm all good with doing another release, but wanted to ask first: given the small glitches we missed here and there with the sarif helper, did you test the latest fix in a client project before release, by making that project point to a8c-ci-toolkit#trunk (or a8c-ci-toolkit#{commitsha}) then create test branches and PRs to validate it works? That way we can find potential other issues before doing a new release instead of having to do a 3.6.3 in case we find out we missed another silly thing in 3.6.2 🙃

[wzieba]

Usually, I do this, but the thing to test here is about uploading a sarif fail on a main branch. So I'd have to merge a8c-ci-toolkit#trunk to main branch of a project, which is something I wanted to omit :/ .

[AliSoftware]

So I'd have to merge a8c-ci-toolkit#trunk to main branch of a project, which is something I wanted to omit :/ .

Ah, got it! Makes sense 👍

[wzieba]

On the second thought, let's test this because I'm quite weary of releasing the toolkit 😅

[wzieba]

Worked as expected 🎉 https://github.com/Automattic/pocket-casts-android/security/code-scanning