Bump org.sonarsource.scanner.maven:sonar-maven-plugin from 4.0.0.4121 to 5.0.0.4389 #580

	name: build

	on:
	push:
	# Avoid workflow run for _merged_ `dependabot` PRs.
	# They were (hopefully!) already tested in PR-triggered workflow.
	branches-ignore: "dependabot/**"
	pull_request:
	paths-ignore:
	- "**.adoc"
	- "**.md"
	- "**.txt"

	permissions:
	contents: write
	pull-requests: write

	jobs:
	echo:
	runs-on: ubuntu-latest
	steps:
	- name: "Echo environment"
	run: \|
	echo "${{github.event_name}}"
	echo "${{github.actor}}"
	echo "${{github.event.pull_request.html_url}}"

	build:
	if: github.event_name == 'pull_request'
	runs-on: ${{ matrix.os }}
	needs: echo

	strategy:
	matrix:
	os: [ macos-latest, ubuntu-latest, windows-latest ]
	version: [11, 17, 21]

	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

	- name: Setup JDKs
	uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
	with:
	distribution: temurin
	java-version: ${{ matrix.version }}
	java-package: jdk
	architecture: x64
	cache: maven

	- name: Build
	shell: bash
	run: mvn --batch-mode clean verify

	merge:
	if: github.event_name == 'pull_request' && github.actor == 'dependabot[bot]'
	runs-on: ubuntu-latest
	needs: build

	steps:
	- name: "[dependabot] Fetch metadata"
	id: metadata
	uses: dependabot/[email protected]
	with:
	github-token: "${{ secrets.GITHUB_TOKEN }}"

	- name: "[dependabot] Auto-merge the PR"
	run: gh pr merge --auto --squash "$PR_URL"
	env:
	PR_URL: ${{ github.event.pull_request.html_url }}
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback