BUILD-11393: Fix check-sca failures caused by local-ref

[bwalsh434]

Context

• Repos are experiencing failures like this one - Error: Can't find 'action.yml', 'action.yaml' or 'Dockerfile' under '/home/runner/work/sonarcloud-cleancode/sonarcloud-cleancode/check-sca'. Did you forget to run actions/checkout before running your local action?
  • This was caused by this commit - 9456e3a#diff-c12f6b4c7fa14717502e927e2a8baeb299a09138c09390c127fba9e2c8766371R16-R18

What Changed?

• Fixed by changing ref back to the full repo + action@master rather than local ref, as the local ref doesn't work when called from the ruleset.

[hashicorp-vault-sonar-prod]

BUILD-11393

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Summary

This PR fixes check-sca workflow failures by reverting from a local action reference (./check-sca) to the full remote reference (SonarSource/ci-github-actions/check-sca@master).

The local reference approach doesn't work when the action is called from rulesets — the workflow engine can't locate the action.yml file at the relative path in that context. Using the full repo reference ensures the action resolves correctly regardless of where it's invoked.

The change also removes the sparse-checkout: check-sca step since the full repository reference no longer needs it.

What reviewers should know

What to review: This is a single YAML file change in .github/workflows/check-sca.yml — straightforward to verify.

Key context: The issue occurs because local action references (relative paths like ./check-sca) only work in the context of the repository where the workflow runs. When called from an external context like a ruleset, the path can't be resolved. The fix uses the canonical remote reference, which works consistently.

Check for: If there are other workflows in this repo that might have adopted the same local reference pattern, they could have the same issue — worth scanning for similar patterns.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, minimal fix. The actions/checkout step is still necessary — check-sca discovers project keys from config files in the calling repo (.sonarlint/connectedMode.json, sonar-project.properties, etc.) via WORKING_DIRECTORY, so the checkout must remain even though the action is now fetched remotely.

🗣️ Give feedback

[Copilot]

Pull request overview

This PR updates the SCA required workflow so it can run the check-sca action from this repository when invoked from consuming repositories via rulesets.

Changes:

• Removes sparse checkout of the local check-sca directory.
• Replaces the local action reference with SonarSource/ci-github-actions/check-sca@master.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.