SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows by henryju · Pull Request #251 · SonarSource/sonarqube-scan-action

henryju · 2026-06-04T12:50:13Z

PowerShell 5.1, used on some Windows GitHub Actions runners, requires Expand-Archive to receive a file with a .zip extension. The @actions/tool-cache downloadTool function saves to a temp path without any extension, causing extraction to fail on PS 5.1. Rename the file to add .zip before calling extractZip.

Please be aware that we are not actively looking for feature contributions. The truth is that it's extremely difficult for someone outside SonarSource to comply with our roadmap and expectations. Therefore, we typically only accept minor cosmetic changes and typo fixes. If you would like to see a new feature, please create a new thread in the forum "Suggest new features".

With that in mind, if you would like to submit a code contribution, make sure that you adhere to the following guidelines and all tests are passing:

Please explain your motives to contribute this change: what problem you are trying to fix, what improvement you are trying to make
Make sure any code you changed is covered by tests
If there is a JIRA ticket available, please make your commits and pull request start with the ticket ID (SONAR-XXXX)

We will try to give you feedback on your contribution as quickly as possible.

Thank You!
The SonarSource Team

Summary by Gitar

Build configuration:
- Added mise.toml to pin the Node.js version to 24.
File system operations:
- Implemented ensureZipExtension to conditionally append .zip to downloaded files.
Testing updates:
- Added unit tests in install-sonar-scanner.test.js to verify file renaming logic and edge cases.

_{This will update automatically on new commits.}

sonarqubecloud · 2026-06-04T12:50:20Z

Agentic Analysis: Early Results

Agentic Analysis and Context Augmentation are available on your project. Here are some issues that could have been prevented. Follow the links to learn how to put them into action.

10 issue(s) found across 1 file(s):

Rule	File	Line	Message
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	252	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	255	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	257	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	286	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	287	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	289	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	310	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	313	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	315	Make sure publicly writable directories are used safely here.
`javascript:S5443`	`src/main/__tests__/install-sonar-scanner.test.js`	345	Make sure publicly writable directories are used safely here.

_{Analyzed by SonarQube Agentic Analysis in 3.3 s}

hashicorp-vault-sonar-prod · 2026-06-04T12:50:27Z

SQSCANGHA-127

…dows PowerShell 5.1, used on some Windows GitHub Actions runners, requires Expand-Archive to receive a file with a .zip extension. The @actions/tool-cache downloadTool function saves to a temp path without any extension, causing extraction to fail on PS 5.1. Rename the file to add .zip before calling extractZip. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sonarqubecloud · 2026-06-08T09:02:27Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

gitar-bot · 2026-06-08T12:52:32Z

Code Review ✅ Approved

Renames downloaded files to include a .zip extension before extraction to ensure compatibility with PowerShell 5.1 on Windows runners. Added pinning for Node.js version and verified the fix with new unit tests; no issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

_{Was this helpful? React with 👍 / 👎 | Gitar}

…(#12) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [SonarSource/sonarqube-scan-action](https://github.com/SonarSource/sonarqube-scan-action) | action | minor | `v8.1` → `v8.2` | --- ### Release Notes <details> <summary>SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)</summary> ### [`v8.2.0`](https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v8.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v8.2.0...v8.2.0) #### What's Changed - SQSCANGHA-149 Add scannerBinariesAuthHeader input by [@henryju](https://github.com/henryju) in [#246](SonarSource/sonarqube-scan-action#246) - SQSCANGHA-88 Deprecate the SONARCLOUD\_URL env variable support by [@henryju](https://github.com/henryju) in [#249](SonarSource/sonarqube-scan-action#249) - SQSCANGHA-84 Remove outdated wget/curl references by [@henryju](https://github.com/henryju) in [#248](SonarSource/sonarqube-scan-action#248) - SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4-part version by [@henryju](https://github.com/henryju) in [#250](SonarSource/sonarqube-scan-action#250) - SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows by [@henryju](https://github.com/henryju) in [#251](SonarSource/sonarqube-scan-action#251) **Full Changelog**: <SonarSource/sonarqube-scan-action@v8...v8.2.0> ### [`v8.2`](SonarSource/sonarqube-scan-action@v8.1.0...v8.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v8.1.0...v8.2.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/epage-go/pulls/12 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

…(#455) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [SonarSource/sonarqube-scan-action](https://github.com/SonarSource/sonarqube-scan-action) | action | minor | `v8.1` → `v8.2` | --- ### Release Notes <details> <summary>SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)</summary> ### [`v8.2.0`](https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v8.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v8.2.0...v8.2.0) #### What's Changed - SQSCANGHA-149 Add scannerBinariesAuthHeader input by [@henryju](https://github.com/henryju) in [#246](SonarSource/sonarqube-scan-action#246) - SQSCANGHA-88 Deprecate the SONARCLOUD\_URL env variable support by [@henryju](https://github.com/henryju) in [#249](SonarSource/sonarqube-scan-action#249) - SQSCANGHA-84 Remove outdated wget/curl references by [@henryju](https://github.com/henryju) in [#248](SonarSource/sonarqube-scan-action#248) - SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4-part version by [@henryju](https://github.com/henryju) in [#250](SonarSource/sonarqube-scan-action#250) - SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows by [@henryju](https://github.com/henryju) in [#251](SonarSource/sonarqube-scan-action#251) **Full Changelog**: <SonarSource/sonarqube-scan-action@v8...v8.2.0> ### [`v8.2`](SonarSource/sonarqube-scan-action@v8.1.0...v8.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v8.1.0...v8.2.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/roboluke/pulls/455 Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

…(#453) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [SonarSource/sonarqube-scan-action](https://github.com/SonarSource/sonarqube-scan-action) | action | minor | `v8.1` → `v8.2` | --- ### Release Notes <details> <summary>SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)</summary> ### [`v8.2.0`](https://github.com/SonarSource/sonarqube-scan-action/releases/tag/v8.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v8.2.0...v8.2.0) #### What's Changed - SQSCANGHA-149 Add scannerBinariesAuthHeader input by [@henryju](https://github.com/henryju) in [#246](SonarSource/sonarqube-scan-action#246) - SQSCANGHA-88 Deprecate the SONARCLOUD\_URL env variable support by [@henryju](https://github.com/henryju) in [#249](SonarSource/sonarqube-scan-action#249) - SQSCANGHA-84 Remove outdated wget/curl references by [@henryju](https://github.com/henryju) in [#248](SonarSource/sonarqube-scan-action#248) - SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4-part version by [@henryju](https://github.com/henryju) in [#250](SonarSource/sonarqube-scan-action#250) - SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows by [@henryju](https://github.com/henryju) in [#251](SonarSource/sonarqube-scan-action#251) **Full Changelog**: <SonarSource/sonarqube-scan-action@v8...v8.2.0> ### [`v8.2`](SonarSource/sonarqube-scan-action@v8.1.0...v8.2.0) [Compare Source](SonarSource/sonarqube-scan-action@v8.1.0...v8.2.0) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.tainton.uk/repos/pypilot/pulls/453 Reviewed-by: Luke Tainton <luke@tainton.uk> Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk> Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>

henryju temporarily deployed to sca-checking June 4, 2026 12:50 — with GitHub Actions Inactive

henryju temporarily deployed to sca-checking June 4, 2026 14:18 — with GitHub Actions Inactive

henryju temporarily deployed to sca-checking June 4, 2026 14:19 — with GitHub Actions Inactive

henryju requested a review from jerome-chetelat-sonarsource June 4, 2026 14:41

henryju force-pushed the worktree-SQSCANGHA-127 branch from 68a8c82 to b24f324 Compare June 4, 2026 14:44

henryju temporarily deployed to sca-checking June 4, 2026 14:44 — with GitHub Actions Inactive

henryju marked this pull request as ready for review June 4, 2026 14:53

henryju requested review from antoine-vinot-sonarsource and removed request for jerome-chetelat-sonarsource June 8, 2026 08:58

henryju force-pushed the worktree-SQSCANGHA-127 branch from b24f324 to af0fbd4 Compare June 8, 2026 09:01

henryju temporarily deployed to sca-checking June 8, 2026 09:02 — with GitHub Actions Inactive

antoine-vinot-sonarsource approved these changes Jun 8, 2026

View reviewed changes

henryju merged commit 7138816 into master Jun 8, 2026
75 checks passed

henryju deleted the worktree-SQSCANGHA-127 branch June 8, 2026 12:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows#251

SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows#251
henryju merged 1 commit into
masterfrom
worktree-SQSCANGHA-127

henryju commented Jun 4, 2026 •

edited by gitar-bot Bot

Loading

Uh oh!

sonarqubecloud Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jun 4, 2026 •

edited by atlassian Bot

Loading

Uh oh!

sonarqubecloud Bot commented Jun 8, 2026

Uh oh!

Uh oh!

gitar-bot Bot commented Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

henryju commented Jun 4, 2026 • edited by gitar-bot Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Gitar

Uh oh!

sonarqubecloud Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Agentic Analysis: Early Results

Uh oh!

hashicorp-vault-sonar-prod Bot commented Jun 4, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jun 8, 2026

Quality Gate passed

Uh oh!

Uh oh!

gitar-bot Bot commented Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

henryju commented Jun 4, 2026 •

edited by gitar-bot Bot

Loading

sonarqubecloud Bot commented Jun 4, 2026 •

edited

Loading

hashicorp-vault-sonar-prod Bot commented Jun 4, 2026 •

edited by atlassian Bot

Loading