BUILD-12308 Migrate eligible jobs to self-hosted runners

[jayadeep-km-sonarsource]

BUILD-12308

Purpose

Self-hosted runners should be used in all cases except approved use cases where self-hosted runners do not work. They are more cost-efficient and faster than GitHub-hosted runners.

This PR migrates eligible Linux workflow jobs to SonarSource self-hosted runner labels, including automation, release, build, test, analysis, and promotion jobs. Existing Windows jobs already use Warp runners.

Retained jobs

• macOS signing and notarization remains on GitHub-hosted macOS because there is no supported self-hosted macOS equivalent.
• Generated agent lock workflows remain unchanged and require their supported regeneration path.
• The RequestReview workflow remains on its current hosted alias and needs squad confirmation; if it is not an approved exception, it should be moved to sonar-xs before merge.

The owning squad should validate these retained cases against the approved exceptions before merging.

Validation

• git diff --check
• Scoped actionlint; passed after excluding expected unknown-label diagnostics for SonarSource custom runner labels and unrelated pre-existing shellcheck findings.

Tracking

• Subtask: https://sonarsource.atlassian.net/browse/BUILD-12308
• Parent: https://sonarsource.atlassian.net/browse/BUILD-12470
• Migration initiative: https://sonarsource.atlassian.net/browse/BUILD-12260

Owning squad: please take over final workflow validation and merge this PR. Let us know if you encounter any issues.

[netlify]

✅ Deploy Preview for sonarqube-cli canceled.

Name	Link
🔨 Latest commit	f452d3e
🔍 Latest deploy log	https://app.netlify.com/projects/sonarqube-cli/deploys/6a9ac76579564a0008757409

[hashicorp-vault-sonar-prod]

BUILD-12308

[gitar-bot]

CI failed: Build failure due to SSL certificate verification error (UNABLE_TO_VERIFY_LEAF_SIGNATURE) when downloading a binary inside the build script on a newly migrated self-hosted runner.

Overview

1 change-related build failure found across 1 analyzed log, caused by an SSL certificate verification issue while downloading a dependency/binary on a self-hosted runner.

Failures

SSL Certificate Verification Failure during Binary Download (confidence: high)

• Type: build
• Affected jobs: 101040341611
• Related to change: yes
• Root cause: The build script attempts to download 'bun-linux-aarch64', which fails with an 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' error due to missing trusted CA certificates or SSL interception on the self-hosted runner environment.
• Suggested fix: Configure the self-hosted runner to trust the appropriate certificate authorities or set the NODE_EXTRA_CA_CERTS environment variable.

Summary

• Change-related failures: 1 build failure due to self-hosted runner SSL/certificate configuration during binary download.
• Infrastructure/flaky failures: None
• Recommended action: Update the self-hosted runner environment's trust store or configure the correct CA certificates to allow secure downloads.

Code Review ✅ Approved

Migrates eligible Linux workflow jobs to SonarSource self-hosted runner labels across automation, release, build, test, analysis, and promotion workflows. Retains macOS GitHub-hosted runners (no self-hosted equivalent), generated agent lock workflows, and RequestReview workflow pending squad validation against approved exceptions. No issues found.

Implementation Status ✅ 1 of 1 objectives covered

✅ BUILD-12308 - 1 of 1 objectives covered

This PR migrates eligible GitHub-hosted runner jobs in the CI workflows to self-hosted runner classes.

✅ 1 covered here

• ✅ Assess sonarqube-cli GitHub-hosted jobs and migrate eligible workloads to approved self-hosted runner classes

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonar-platform-bot]

Closing this copy so the PR can be recreated under the Sonar Platform Bot identity.

[sonar-platform-bot]

Recreated under the Sonar Platform Bot identity: #779