SCANPY-252 Migrate Poetry workflows to official actions

[Seppli11]

Summary

• replace local config-poetry action usage with SonarSource/ci-github-actions/config-poetry@v1
• keep build jobs on SonarSource/ci-github-actions/build-poetry@v1
• remove the local config-poetry action files

Local validation

• rg "./.github/actions/config-poetry" .github
• python3 YAML parse for .github/workflows/*.yml
• git diff --check

Note: actionlint is not installed locally.

---

Summary by Gitar

• Tooling and environment:
  • Integrated jdx/mise-action@v4.0.1 across all jobs in build.yml and MacOsNightly.yml for unified Python tool management.
  • Updated jfrog-cli to 2.96.0 in mise.toml.
  • Defined MISE experimental environment variables and Poetry cache paths in workflow global scopes.
• Pipeline enhancements:
  • Added shadow-scans and iris sync jobs to the build workflow for automated analysis.
  • Added scheduled daily triggers to build.yml and restricted promote job execution conditions.
• CI/CD migration:
  • Replaced local config-poetry action with SonarSource/ci-github-actions/config-poetry@v1 and removed local action files.
• Cleanup:
  • Removed Iris.yml workflow and redundant local action symlinks.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SCANPY-252

[zglicz]

small nits

[zglicz]

seems like you are running the exact same steps as above and also below, perhaps you want to create an anchor that you can reference so they don't run out of sync or you don't need to update it in 3 places.

[Seppli11]

Personally, I really don't like them. I find that they make the CI harder to read. As such, I would prefer leaving the duplication in

[zglicz]

in SonarJS, we actually put this job into the build so that we can safely run it after the analyze has already finished and was succesful.

[Seppli11]

That would make sense. I'll see if I can get rid of the Iris.yml workflow

[Seppli11]

I removed the Iris.yml workflow and integrated it instead in the build.yml workflow. It is somewhat hard to test on a feature branch due to how the build-poetry action is built. But I think it make sense

[gitar-bot]

💡 Quality: IRIS sync now runs on every master push, not just schedule

The old Iris.yml workflow triggered IRIS sync only on a daily schedule (cron 0 2 * * *) and workflow_dispatch. By moving the shadow-scans and iris jobs into build.yml, these jobs now also run on every push to master (and on the build workflow's 0 1 * * * schedule), because the if condition github.ref == 'refs/heads/master' || github.event_name == 'workflow_dispatch' is satisfied by push events to master.

This significantly increases how often IRIS sync and shadow scans execute (every merge to master vs. once daily). If this increased frequency is intentional for dogfooding, no change is needed. If IRIS sync is meant to remain a daily/manual operation, consider also gating on github.event_name == 'schedule' (e.g. github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') to preserve the previous cadence.

_{Was this helpful? React with 👍 / 👎}

[sonarqube-next]

Quality Gate passed for 'Python Scanner'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[gitar-bot]

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Migrates local Poetry workflows to official SonarSource actions and integrates jdx/mise-action for centralized tool management. Ensure the new IRIS sync job is scoped to scheduled runs only to avoid unnecessary resource consumption on every master push.

💡 Quality: IRIS sync now runs on every master push, not just schedule

📄 .github/workflows/build.yml:176-190

The old Iris.yml workflow triggered IRIS sync only on a daily schedule (cron 0 2 * * *) and workflow_dispatch. By moving the shadow-scans and iris jobs into build.yml, these jobs now also run on every push to master (and on the build workflow's 0 1 * * * schedule), because the if condition github.ref == 'refs/heads/master' || github.event_name == 'workflow_dispatch' is satisfied by push events to master.

This significantly increases how often IRIS sync and shadow scans execute (every merge to master vs. once daily). If this increased frequency is intentional for dogfooding, no change is needed. If IRIS sync is meant to remain a daily/manual operation, consider also gating on github.event_name == 'schedule' (e.g. github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') to preserve the previous cadence.

🤖 Prompt for agents

Code Review: Migrates local Poetry workflows to official SonarSource actions and integrates `jdx/mise-action` for centralized tool management. Ensure the new IRIS sync job is scoped to scheduled runs only to avoid unnecessary resource consumption on every master push.

1. 💡 Quality: IRIS sync now runs on every master push, not just schedule
   Files: .github/workflows/build.yml:176-190

   The old `Iris.yml` workflow triggered IRIS sync only on a daily schedule (cron `0 2 * * *`) and `workflow_dispatch`. By moving the `shadow-scans` and `iris` jobs into `build.yml`, these jobs now also run on every `push` to `master` (and on the build workflow's `0 1 * * *` schedule), because the `if` condition `github.ref == 'refs/heads/master' || github.event_name == 'workflow_dispatch'` is satisfied by push events to master.
   
   This significantly increases how often IRIS sync and shadow scans execute (every merge to master vs. once daily). If this increased frequency is intentional for dogfooding, no change is needed. If IRIS sync is meant to remain a daily/manual operation, consider also gating on `github.event_name == 'schedule'` (e.g. `github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'`) to preserve the previous cadence.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}