GHA-216 Fix --force-with-lease failing with stale ref on bot branch

[nils-werner-sonarsource]

Summary

• Switches git push --force-with-lease to git push --force in create-pull-request/action.yml

Context

GHA-216 introduced a stable bot branch name (bot/update-rule-metadata) instead of timestamped branches. This causes --force-with-lease to fail with "stale info" in shallow CI checkouts: the remote-tracking ref refs/remotes/origin/bot/update-rule-metadata is absent from the shallow clone, so git has no expected value to compare against and rejects the push.

Since the bot/update-rule-metadata branch is exclusively managed by this action (no human commits), --force is safe — there is no risk of overwriting unrelated work.

Fixes: https://sonarsource.atlassian.net/browse/GHA-216

🤖 Generated with Claude Code

[sonar-review-alpha]

Summary

Changes git push --force-with-lease to git push --force when pushing the bot-managed branch. The lease check fails in shallow CI checkouts because the remote-tracking ref is unavailable, but using --force is safe here since only this action manages the branch — there's no human work to overwrite.

What reviewers should know

This is a single-line change in create-pull-request/action.yml. The key insight: --force-with-lease is a safer alternative to --force because it checks that the remote hasn't changed unexpectedly. However, in shallow clones (used in CI), git doesn't have the remote-tracking ref to compare against, so the check always fails. Since the bot branch is exclusively managed by this action with no concurrent manual updates, --force is the pragmatic choice. The updated comment explains this tradeoff clearly.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[hashicorp-vault-sonar-prod]

GHA-216

[sonarqubecloud]

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Conclusion: Clean, well-scoped fix. The switch from --force-with-lease to --force is the correct solution given the bot-owned branch invariant, and the inline comment documents the safety reasoning clearly.

🗣️ Give feedback