Add reusable SonarQube scan workflow

.github/workflows/CHANGELOGS/run_sonar_scan.md

@@ -0,0 +1,11 @@
+# Run SonarQube Scan Workflow Changelog
+
+All notable changes to the **run_sonar_scan** callable workflow are documented in this file.
+
+## 1.0.0
+
+### Added
+
+- First release of the `run_sonar_scan` reusable workflow.
+- Defaults to scanning the ref that triggered the caller's workflow and optionally accepts a commit SHA, tag, or branch.
+- Runs the SonarQube scan with full Git history and an explicitly mapped `SONAR_TOKEN` secret.

.github/workflows/READMES/run_sonar_scan.md

@@ -0,0 +1,45 @@
+# Run SonarQube Scan
+
+This reusable workflow checks out the ref that triggered the caller, or a specified commit or ref, and runs a SonarQube scan with full Git history.
+
+## Prerequisites
+
+The consuming repository must include its SonarQube configuration, such as a `sonar-project.properties` file, or otherwise provide configuration supported by the scan action.
+
+## Usage
+
+```yaml
+jobs:
+  sonar-scan:
+    uses: OpenSesame/core-github-actions/.github/workflows/run_sonar_scan.yml@workflows/run_sonar_scan/1.0.0
+    secrets:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+```
+
+To scan a different commit, tag, or branch, pass `commit-identifier`:
+
+```yaml
+with:
+  commit-identifier: ${{ github.sha }}
+```
+
+## Inputs
+
+| Input               | Type   | Required | Default               | Description                                       |
+| ------------------- | ------ | -------- | --------------------- | ------------------------------------------------- |
+| `commit-identifier` | string | No       | Triggering ref or SHA | Commit SHA, tag, or branch to check out and scan. |
+
+## Secrets
+
+| Secret        | Required | Description                                    |
+| ------------- | -------- | ---------------------------------------------- |
+| `SONAR_TOKEN` | Yes      | Token used to authenticate the SonarQube scan. |
+
+## Contribution
+
+- Update the workflow, README, and changelog together.
+- Create a PR and set a version label following the [versioning instructions](../../../VERSIONING.md).
+
+## References
+
+- [SonarQube scan action](https://github.com/SonarSource/sonarqube-scan-action)

.github/workflows/run_sonar_scan.yml

@@ -0,0 +1,33 @@
+name: SonarQube Scan
+
+on:
+  workflow_call:
+    inputs:
+      commit-identifier:
+        description: Commit SHA or ref to scan; defaults to the ref that triggered the workflow
+        type: string
+        required: false
+        default: ''
+    secrets:
+      SONAR_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  sonar-scan:
+    name: Run SonarQube scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.commit-identifier }}
+          fetch-depth: 0
+
+      - name: Run SonarQube scan
+        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.gitignore

@@ -1,7 +1,6 @@
 # Compiled output
 dist/
 **/dist/
-build/
 **/build/
 
 # Dependencies

build-apply/README.md

@@ -1,9 +1,17 @@
+# Build-Apply Composite Action
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
 
+Known Consumers - Audited Sept 2026
+
+* [player-ingestion](https://github.com/OpenSesame/player-ingestion)
+* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure)
+* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router)
+
 ### Overview
 
 The build-apply composite action builds and applies the current branch to a destination environment.

build-publish/README.md

@@ -1,9 +1,17 @@
+# Build-Publish Composite Action
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
+Known Consumers - Audited Sept 2026
 
+* [core-build-library](https://github.com/OpenSesame/core-build-library)
+* [core-repo-template](https://github.com/OpenSesame/core-repo-template)
+* [identity-messages](https://github.com/OpenSesame/identity-messages)
+* [player-messages](https://github.com/OpenSesame/player-messages)
+
 ### Overview
 
 The publish composite action builds a library and publishes it to the configured registry.

build/README.md

@@ -1,8 +1,17 @@
+# Build Composite Action
+
 ## ❌ Deprecation Notice
+
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
 
+Known Consumers - Audited Sept 2026
+
+* [player-ingestion](https://github.com/OpenSesame/player-ingestion)
+* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure)
+* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router)
+
 ### Overview
 
 The build composite action generates and builds the code.

cleanup/README.md

@@ -1,9 +1,17 @@
+# Cleanup Composite Action
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
 
+Known Consumers - Audited Sept 2026
+
+* [identity-saml-test-idp](https://github.com/OpenSesame/identity-saml-test-idp)
+* [player-ingestion](https://github.com/OpenSesame/player-ingestion)
+* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router)
+
 ### Overview
 
 The cleanup composite action destroys terraform resources in a target environment

deploy/README.md

@@ -1,9 +1,17 @@
+# Deploy Composite Action
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
 
+Known Consumers - Audited Sept 2026
+
+* [player-ingestion](https://github.com/OpenSesame/player-ingestion)
+* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure)
+* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router)
+
 ### Overview
 
 The deploy composite action runs npm commands to deploy to a target environment, followed by post-deployment contract tests.

select-branch-workspace/README.md

@@ -1,10 +1,16 @@
+# Select Branch Workspace Composite Action
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
 
-# Overview
+Known Consumers - Audited Sept 2026
+
+* [identity-userstore](https://github.com/OpenSesame/identity-userstore)
+
+### Overview
 
 Takes in a string input meant to be the name of a branch.
 The branch name is sanitized to be used as a workspace name.

semgrep/README.md

@@ -1,25 +1,34 @@
+# Semgrep CE Scan Composite Action
+
+This action runs Semgrep security scanning with configurable options and reporting capabilities.
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
-If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
+We suggest consumers switch over to the reusable workflow for [semgrep scan](https://github.com/OpenSesame/.github/blob/main/.github/workflows/semgrep-scan.yml) so it can be run in parallel with your other jobs.
 
-# Semgrep CE Scan Action
+Known Consumers - Audited Sept 2026
 
-This action runs Semgrep security scanning with configurable options and reporting capabilities.
+* [identity-idp-api](https://github.com/OpenSesame/identity-idp-api)
+* [identity-catalog-okta](https://github.com/OpenSesame/identity-catalog-okta)
+* [core-orchestrator](https://github.com/OpenSesame/core-orchestrator)
+* [core-okta-widget](https://github.com/OpenSesame/core-okta-widget)
+* [core-mfe-error-page](https://github.com/OpenSesame/core-mfe-error-page)
+* [core-pii-scrubber](https://github.com/OpenSesame/core-pii-scrubber)
 
 ## Features
 
-- **Configurable scan modes**: diff, full, or baseline scanning
-- **Multiple severity levels**: error, warning, info
-- **Reviewdog integration**: Inline PR comments for findings
-- **PR summary comments**: Automated PR comments with scan results
-- **Flexible configuration**: Support for custom Semgrep rulesets
+* **Configurable scan modes**: diff, full, or baseline scanning
+* **Multiple severity levels**: error, warning, info
+* **Reviewdog integration**: Inline PR comments for findings
+* **PR summary comments**: Automated PR comments with scan results
+* **Flexible configuration**: Support for custom Semgrep rulesets
 
 ## Inputs
 
 | Input | Description | Required | Default |
-|-------|-------------|----------|---------|
+| ----- | ----------- | -------- | ------- |
 | `branch_name` | The name of the branch where lint is running | No | - |
 | `semgrep_config` | Rulesets to run with Semgrep | No | `p/default` |
 | `fail_severity` | Severity level that causes the action to fail | No | `error` |
@@ -30,7 +39,7 @@ This action runs Semgrep security scanning with configurable options and reporti
 ## Outputs
 
 | Output | Description |
-|--------|-------------|
+| ------ | ----------- |
 | `total_findings` | Total number of findings from the scan |
 | `error_count` | Number of error-level findings |
 | `warning_count` | Number of warning-level findings |
@@ -81,30 +90,33 @@ This action runs Semgrep security scanning with configurable options and reporti
 ## Scan Modes
 
 ### Diff Mode (Default)
-- Scans only changed files in PRs
-- Compares against the base branch
-- Fastest option for PR workflows
+
+* Scans only changed files in PRs
+* Compares against the base branch
+* Fastest option for PR workflows
 
 ### Full Mode
-- Scans entire codebase
-- Comprehensive security review
-- Best for main branch or release workflows
+
+* Scans entire codebase
+* Comprehensive security review
+* Best for main branch or release workflows
 
 ### Baseline Mode
-- Scans against a baseline commit (usually main)
-- Good for tracking security debt
-- Shows new issues since baseline
+
+* Scans against a baseline commit (usually main)
+* Good for tracking security debt
+* Shows new issues since baseline
 
 ## Severity Levels
 
-- **error**: High-severity security issues that should block deployment
-- **warning**: Medium-severity issues that should be reviewed
-- **info**: Low-severity issues or informational findings
+* **error**: High-severity security issues that should block deployment
+* **warning**: Medium-severity issues that should be reviewed
+* **info**: Low-severity issues or informational findings
 
 ## Reviewdog Reporters
 
-- **github-pr-review**: Inline comments on specific lines in PR
-- **github-pr-check**: Summary in PR checks without inline comments
+* **github-pr-review**: Inline comments on specific lines in PR
+* **github-pr-check**: Summary in PR checks without inline comments
 
 ## Permissions Required
 
@@ -150,7 +162,7 @@ jobs:
 
 ## Notes
 
-- The action automatically installs Semgrep version 1.124.0
-- Git history is required for diff mode scanning
-- The action will fail if error-level findings are detected (configurable)
-- PR comments are automatically updated on subsequent runs 
+* The action automatically installs Semgrep version 1.124.0
+* Git history is required for diff mode scanning
+* The action will fail if error-level findings are detected (configurable)
+* PR comments are automatically updated on subsequent runs

tf-apply/README.md

@@ -1,9 +1,13 @@
+# Terraform Apply Composite Action
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
 
+No Known Consumers - Audited Sept 2026
+
 ### Overview
 
 The tf-apply composite action initializes, validates and apply terraform resources whilst selecting the desired workspace.

tf-plan-comment/README.md

@@ -1,14 +1,37 @@
+# Terraform Plan Comment Composite Action
+
 ## ❌ Deprecation Notice
 
 This composite action is no longer maintained by the Core Services team. Use at your own risk.
 
 If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it.
 
+Known Consumers - Audited Sept 2026
+
+* [catalog-feedback-service](https://github.com/OpenSesame/catalog-feedback-service)
+* [catalog-search-proxy](https://github.com/OpenSesame/catalog-search-proxy)
+* [catalog-service-template](https://github.com/OpenSesame/catalog-service-template)
+* [core-mfe-auth-invitations](https://github.com/OpenSesame/core-mfe-auth-invitations)
+* [core-mfe-error-page](https://github.com/OpenSesame/core-mfe-error-page)
+* [core-mfe-profile-manager](https://github.com/OpenSesame/core-mfe-profile-manager)
+* [core-mfe-template](https://github.com/OpenSesame/core-mfe-template)
+* [core-mfe-terms-and-conditions](https://github.com/OpenSesame/core-mfe-terms-and-conditions)
+* [core-okta-widget](https://github.com/OpenSesame/core-okta-widget)
+* [core-orchestrator](https://github.com/OpenSesame/core-orchestrator)
+* [identity-catalog-okta](https://github.com/OpenSesame/identity-catalog-okta)
+* [identity-idp-api](https://github.com/OpenSesame/identity-idp-api)
+* [identity-learner-okta](https://github.com/OpenSesame/identity-learner-okta)
+* [identity-okta](https://github.com/OpenSesame/identity-okta)
+* [identity-saml-test-idp](https://github.com/OpenSesame/identity-saml-test-idp)
+* [identity-userstore](https://github.com/OpenSesame/identity-userstore)
+* [identity-userstore-infrastructure](https://github.com/OpenSesame/identity-userstore-infrastructure)
+* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure)
+* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router)
+
 ### Overview
 
 The tf-plan-comment composite action initializes actions/github-scripts. Bringing the script under core-github-actions allows us to be more modularized. We can now make any changes to the desired output in one area and have it apply to all the repos utilizing it.
 
 The action will do the following:
 
 1. Output the terraform plan onto the pull request for easy access and readability.
-