MCP-439 Pin build-gradle to v1.3.24 to fix Renovate

[nquinquenel]

No description provided.

[hashicorp-vault-sonar-prod]

MCP-439

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Summary

Pins the build-gradle workflow action to a specific commit (v1.3.24) instead of the master branch in the shadow scans GitHub Actions workflow. This replaces the unstable @master reference with a pinned commit hash @148774f456203f228b7bd1bd68ed0c22254d9cd1, making the dependency explicit and allowing Renovate to track updates properly. Also fixes a trailing newline in the file.

What reviewers should know

What changed:

• .github/workflows/shadow_scans.yml: Updated the build-gradle action reference from @master (marked as "dogfood") to a pinned commit hash

Why it matters:
Using @master in GitHub Actions is problematic for Renovate because it's a constantly moving target. Renovate cannot reliably detect or suggest updates to moving branch references. Pinning to a specific commit with a version tag (v1.3.24) makes the dependency explicit and enables Renovate to track and propose version updates.

For reviewers:

• Confirm the pinned commit hash 148774f456203f228b7bd1bd68ed0c22254d9cd1 corresponds to the intended v1.3.24 release
• This is a low-risk change that improves dependency management without altering workflow behavior

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

The fix correctly moves off @master so Renovate can track the dependency, but the chosen version (v1.3.24) is behind what the rest of the repo already uses (v1.3.29 in build.yml and pr-cleanup.yml). Also note the comment format inconsistency: this file uses # v1.3.24 while the other files omit the v prefix (# 1.3.29).

🗣️ Give feedback