Add reusable SonarQube scan workflow

[sarasvoss]

PR Summary

Jira: N/A

Description of Changes

• Add a reusable SonarQube scan workflow with immutable action pins and read-only permissions.
• Allow callers to optionally select a commit SHA, tag, or branch while defaulting to the triggering ref.
• Add workflow usage documentation and the initial 1.0.0 changelog.
• Document known consumers of deprecated root-level composite actions.
• Refresh transitive dependencies in the npm lockfile.

Versioning

• No — label this PR with version:untracked
• Yes
  • Version label: version:workflows/run_sonar_scan/1.0.0
  • Changelog includes the 1.0.0 release entry.

Dependencies of PR

None.

Testing

• npm test -- --runInBand (55 tests passed)
• npm run lint:check
• npm run format:check
• actionlint .github/workflows/run_sonar_scan.yml
• Version-label validation for workflows/run_sonar_scan/1.0.0
• git diff --check origin/main...HEAD

[github-actions]

Tags

The following tags will be created on main after merge

🏷️ workflows/run_sonar_scan/1.0.0

[coderabbitai]

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sonar_scan

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Semgrep Security Scan Passed

🎉 No security issues found!

View run
_{🤖 Powered by Semgrep + reviewdog}

[Copilot]

🟡 Changes recommended

Add SonarQube server URL support or requirements and reconcile the repository workflow guidance.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a reusable, versioned SonarQube workflow with pinned actions, configurable refs, documentation, changelog updates, and dependency refreshes.

Changes:

• Adds the SonarQube workflow and usage documentation.
• Documents deprecated action consumers.
• Refreshes npm dependencies and release metadata.

File summaries

File	Summary
tf-plan/README.md	Documents deprecated action consumers.
tf-plan-comment/README.md	Documents deprecated action consumers.
tf-apply/README.md	Documents consumer status.
semgrep/README.md	Updates deprecation and consumer details.
select-branch-workspace/README.md	Documents deprecated action consumers.
package-lock.json	Refreshes transitive dependencies.
deploy/README.md	Documents deprecated action consumers.
cleanup/README.md	Documents deprecated action consumers.
build/README.md	Documents deprecated action consumers.
build-publish/README.md	Documents deprecated action consumers.
build-apply/README.md	Documents deprecated action consumers.
.gitignore	Adjusts ignore rules.
.github/workflows/run_sonar_scan.yml	Adds the reusable SonarQube workflow; SONAR_HOST_URL still needs to be supported or explicitly required.
.github/workflows/READMES/run_sonar_scan.md	Documents workflow usage; server URL requirements need clarification.
.github/workflows/CHANGELOGS/run_sonar_scan.md	Adds the initial 1.0.0 changelog; repository-level workflow guidance is inconsistent.

Review details

Suppressed comments (2)

.github/workflows/CHANGELOGS/run_sonar_scan.md:5

• This release makes reusable workflows broader than Terraform and introduces a versioned workflow, but the top-level README.md:82-88 still says reusable workflows are Terraform-only, unversioned, and should use legacy-stable. Please update that repository guidance in this change so consumers are not given a contradictory migration/versioning policy.

## 1.0.0

.github/workflows/READMES/run_sonar_scan.md:36

• The documented contract lists only SONAR_TOKEN, but a generic SonarQube Server scan also needs the target server URL. Without documenting and forwarding SONAR_HOST_URL (or explicitly requiring sonar.host.url in the caller's configuration), consumers with a non-default server cannot follow this usage successfully.

## Secrets

| Secret        | Required | Description                                    |
| ------------- | -------- | ---------------------------------------------- |
| `SONAR_TOKEN` | Yes      | Token used to authenticate the SonarQube scan. |

• Files reviewed: 13/15 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.