BUILD-10988 Migrate GitHub Actions workflows to sonar-*-public runners

[hedinasr]

BUILD-10988: Migrate sonarlint-intellij to sonar-*-public and sonar-m-docker runners

Replace github-ubuntu-latest-s/github-ubuntu-latest-m runners with SonarSource self-hosted runners across all workflows:

• sonar-xs-public — all lightweight jobs: build-number, aws-auth, build-plugin, test-and-sonar, verify-plugin, promote, dogfood, plugin-verifier-nightly, shadow_scans, and all PR/review event workflows (PullRequestClosed, PullRequestCreated, RequestReview, SubmitReview, notify-failure)
• sonar-m-docker — the qa job, which runs inside a Docker container and requires Docker-in-Docker support

Part of the Milestone 5 migration effort tracked under BUILD-10864.

[hashicorp-vault-sonar-prod]

BUILD-10988

[sonar-review-alpha]

Summary

This PR completes the runner migration across all GitHub Actions workflows. Changes are straightforward but touch multiple layers:

Runner changes: Replaces all github-ubuntu-latest-s/m runners with SonarSource self-hosted runners—sonar-xs-public for lightweight jobs and sonar-m-docker for Docker-in-Docker workloads. Migration is consistently applied across 8 workflow files.

Container user UID fix: Changes Docker container user from runner to 1001 (matching the ARC runner's UID) in 5 jobs to resolve permissions issues.

Develocity endpoint migration: Updates all references from the public endpoint (develocity-public.sonar.build) to what appears to be an internal endpoint (develocity.sonar.build).

What reviewers should know

What to verify:

• Check that all job runner assignments match the documented criteria: sonar-xs-public for non-Docker jobs, sonar-m-docker for jobs requiring Docker-in-Docker
• The container user UID 1001 should align with the actual ARC runner configuration—this is critical for file permissions in mounted volumes and artifact handling
• The develocity endpoint change affects build scans and caching; verify this endpoint is accessible and correctly configured in your environment

Key files to review:

• build.yml contains the majority of changes (4 jobs migrated, develocity URL appears twice)
• shadow_scans.yml and plugin-verifier-nightly.yml for consistency of the same pattern
• All PR workflow files (5 files) for homogeneous changes to lightweight jobs

Non-obvious decisions:

• build-number and aws-auth jobs downgraded from -m to sonar-xs-public despite their -m sizing—verify these lightweight jobs don't need more resources
• The developer didn't migrate these workflows as part of a larger refactoring, suggesting this is the final batch

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback