BUILD-12243: Move verify-sca to sonar-xs

[bwalsh434]

BUILD-12243: Rightsize the SCA verification job by moving it from the WarpBuild custom Ubuntu runner to the sonar-xs runner.

This preserves the workflow permissions, OIDC environment, and action invocation; only the runner label changes.

Test plan

• Parse .github/workflows/check-sca.yml and assert verify-sca.runs-on is sonar-xs.
• Verify sonar-xs is an allowed self-hosted runner label in .github/actionlint.yaml.
• Run git diff --check.
• After merge, monitor the GitHub Actions Runner Performance dashboard after 24 hours, focusing on sonar-xs job startup time and pending runners.

---

Summary by Gitar

• CI workflow updates:
  • Added .github/workflows/test-check-sca.yml to test the SCA check workflow on pull requests.
  • Updated .github/workflows/check-sca.yml to support workflow_call triggers.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

BUILD-12243

[Copilot]

Pull request overview

This PR updates the SCA verification workflow to run on the smaller sonar-xs runner instead of the WarpBuild custom Ubuntu runner, keeping the existing permissions/OIDC environment behavior intact while right-sizing compute.

Changes:

• Switched verify-sca job runner label from warp-custom-ubuntu-24-04 to sonar-xs in the SCA check workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Moves the SCA verification job to the sonar-xs runner to rightsizing infrastructure. Consider addressing the duplicate workflow execution when pull requests touch these workflow files.

💡 Quality: SCA check runs twice on PRs touching these workflow files

_{Reply with Gitar … to ask about this finding.}

check-sca.yml already triggers on pull_request, so its verify-sca job runs directly on every PR. The new test-check-sca.yml also invokes the same reusable workflow via workflow_call on PRs that modify these files, causing the SCA check (and its Vault/OIDC exchange) to execute twice for such PRs. This is functionally harmless but wasteful; consider whether the direct pull_request trigger in check-sca.yml is still needed now that a dedicated test workflow exercises the workflow_call path.

🤖 Prompt for agents

Code Review: Moves the SCA verification job to the sonar-xs runner to rightsizing infrastructure. Consider addressing the duplicate workflow execution when pull requests touch these workflow files.

1. 💡 Quality: SCA check runs twice on PRs touching these workflow files

   check-sca.yml already triggers on `pull_request`, so its `verify-sca` job runs directly on every PR. The new test-check-sca.yml also invokes the same reusable workflow via `workflow_call` on PRs that modify these files, causing the SCA check (and its Vault/OIDC exchange) to execute twice for such PRs. This is functionally harmless but wasteful; consider whether the direct `pull_request` trigger in check-sca.yml is still needed now that a dedicated test workflow exercises the `workflow_call` path.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}