GHA-355 Add statuses: write permission for release-lock feature

[nils-werner-sonarsource]

Context

This PR is part of the release-lock gate rollout (GHA-368, epic GHA-358).

The automated-release.yml reusable workflow in release-github-actions will soon activate Phase 0 of the release-lock gate: at release start and abort, it posts a release-lock commit status on all open PRs. This requires statuses: write on the caller job's GITHUB_TOKEN.

This PR grants that permission ahead of time — while the sweep steps are still no-ops — so that activating the feature later requires no further per-repo changes and doesn't risk disrupting ongoing releases.

Change

Add statuses: write to the permissions: block of the automated-release caller job.

Impact

None on current releases. The permission is additive; the sweep steps in automated-release.yml are currently stubbed out.

[hashicorp-vault-sonar-prod]

GHA-355

[nils-werner-sonarsource]

Closing: the fix is being applied centrally in release-github-actions (vault token approach). No changes needed in caller repos.

[gitar-bot]

CI failed: The build is failing consistently across jobs due to a dependency resolution error involving 'sonar-orchestrator-junit5', which is missing or inaccessible in the remote repository.

Overview

Multiple CI jobs failed during the Gradle build process due to a LockOutOfDateException. The dependency locking mechanism is failing to resolve a specific version of the sonar-orchestrator-junit5 artifact.

Failures

Dependency Resolution Failure (confidence: high)

• Type: dependency
• Affected jobs: 84948395449, 84948395337, 84788192433
• Related to change: no
• Root cause: The Gradle build is restricted by lock files that point to org.sonarsource.orchestrator:sonar-orchestrator-junit5:6.3.0.4458. This specific version appears to be unavailable or cannot be found in the configured Artifactory repositories.
• Suggested fix: Refresh the dependency lock files to include a valid, available version of the artifact. This can typically be achieved by running ./gradlew dependencies --write-locks in the project directory, then committing the updated lock files.

Summary

• Change-related failures: 0
• Infrastructure/flaky failures: 3 (All jobs failed due to the same dependency resolution issue).
• Recommended action: The developer should update the dependency lock files to sync with available versions in Artifactory. Since this is a build configuration issue, it is recommended to verify if this version of the orchestrator was recently retracted or if there is a typo in the dependency declaration.

Code Review ✅ Approved

Adds statuses: write permission to the automated-release workflow to support upcoming release-lock functionality. No issues found.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[felix-pauck-sonarsource]

LGTM! 👍