CLP-1072: Bump ci-github-actions references from v1 to v2

[mary-georgiou]

CLP-1072

Bumps SonarSource/ci-github-actions/*@v1 to @v2 across the repo. Exact refs bumped:

• .github/actions/upload-actual/action.yml:32 config-npm
• .github/workflows/build.yml:37 build-maven
• .github/workflows/build.yml:96 config-maven
• .github/workflows/build.yml:216 config-maven
• .github/workflows/build.yml:265 config-maven
• .github/workflows/build.yml:307 build-maven
• .github/workflows/build.yml:348 config-maven
• .github/workflows/build.yml:393 config-maven
• .github/workflows/build.yml:422 promote
• .github/workflows/pr-cleanup.yml:12 pr_cleanup
• .github/workflows/unified-dogfooding.yml:19 build-maven

No other changes. No standalone get-build-number producer job exists in this repo; the build job's build-maven step output is relayed via needs: build + env to test-analyze and custom-rules-license-check for legitimate build-dependency reasons, so no plumbing cleanup was needed here.

🤖 Generated with Claude Code

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · CI workflows switch to v2 actions, but their implementation changes are not shown.

Updates all SonarSource/ci-github-actions references from v1 to v2 across workflow files and custom actions. No issues found.

Review coverage

🧪 Functional validation 1 of 1 objectives covered

📋 Rules No rules evaluated

🤖 Auto-approval Not enabled · Set up

Implementation Status ✅ 1 of 1 objectives covered

✅ CLP-1072 - 1 of 1 objectives covered

This PR covers bumping the ci-github-actions references from v1 to v2 across the workflow files.

✅ 1 covered here

• ✅ Bump SonarSource/ci-github-actions/*@v1 references to @v2 in sonar-java

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[guillaume-dequenne]

LGTM