SLI-2606 Fix failing shadow scan CI

[nquinquenel]

Following recent refactoring, the CI step was moved to a container, breaking IRIS scan. We should put this one in a separate task, not running in a container.

[hashicorp-vault-sonar-prod]

SLI-2606

[sonar-review-alpha]

Summary

What changed: The IRIS Analysis step has been extracted from the containerized shadow scan job into a separate, dedicated job that runs on a regular GitHub runner instead.

Why: Recent refactoring moved CI steps into a container, which broke IRIS scanning. IRIS analysis requires a non-containerized environment to function properly.

Impact: The IRIS scan will now run independently after the scan job completes, restoring functionality without blocking other CI steps or requiring them to adapt to container constraints.

What reviewers should know

Key changes:

• New iris: job added to the workflow (separate from containerized scan job)
• Job depends on scan job completing first (needs: scan)
• Uses github-ubuntu-latest-m runner (non-containerized environment)
• Includes appropriate permissions for IRIS action (id-token: write)

For reviewers:
The change is minimal and isolated to the workflow file. The IRIS step itself is unchanged; only its execution context is different. Verify that the job dependencies and runner type are appropriate for IRIS requirements.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[sonar-review-alpha]

LGTM! ✅

Clean, minimal fix. The iris job is correctly structured as a standalone job that runs after scan completes — it uses a bare runner (no container: block), which is exactly what IRIS requires. Permissions are appropriately scoped (id-token: write for OIDC token exchange, contents: read only).

🗣️ Give feedback