BUILD-10804 unique check names for branch protection

[julien-carsique-sonarsource]

BUILD-10804 Aggregate all the various tests in each testing workflow into unique stable check names that will be used for the branch protection.

Relates to https://github.com/SonarSource/re-service-config/pull/1834

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Summary

This PR introduces aggregated test jobs across workflows to provide unique, stable check names suitable for branch protection rules. Each workflow (test-action.yml and test-cache-migration-gh2s3.yml) now has an all-green job that depends on all individual test jobs and uses the alls-green action to verify they all pass. This allows branch protection rules to reference a single, stable check name per workflow instead of multiple individual job names. Supporting changes include standardizing runner labels to github-ubuntu-latest-s, updating pre-commit hooks, and adding actionlint validation for GitHub workflows.

What reviewers should know

Start by examining the new aggregator jobs: Look at the all-green job added to test-action.yml (line 337) and test-cache-migration-gh2s3.yml (line 175) to understand the pattern. Each aggregates all test jobs in that workflow using the alls-green action.

Branch protection configuration: These all-green jobs provide stable check names ("All Tests", "All Tests - Cache Migration") that can be used in SonarSource/re-service-config branch protection rules instead of individual job names.

Naming consistency: Note the job rename in test-credential-isolation.yml from credential-isolation-tests to tests-credential-isolation — this aligns with consistent naming conventions across workflows.

Formatting changes: The {} wrapping in test-action.yml echo commands (lines 150-154, 268-276, 289-293) are actionlint style preferences, not functional changes.

Infrastructure changes: Runner labels changed from ubuntu-latest to github-ubuntu-latest-s for consistency; actionlint was added to pre-commit config for YAML validation.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, focused PR — the all-green aggregator jobs are complete (all test jobs accounted for in each needs list), and test-credential-isolation.yml correctly skips an aggregator since it has only one job that already serves as the stable check name.

🗣️ Give feedback