BUILD-11417 Extract symlink keeper into its own sub-action

[julien-carsique-sonarsource]

Summary

• Moves ensureCacheMetricsSymlink out of credential-guard-post into a new symlink-keeper/ sub-action; credential-setup/credential-guard revert to their pre-keeper baseline.
• Registers the new step as the LAST main step of the top-level composite so its post fires FIRST in the LIFO post phase, recreating .actions/cache-metrics before cache-metrics-post resolves uses: ./.actions/cache-metrics.
• Drops the temporary cache-backend == 's3' gate from cache-metrics-prep — metrics can now opt-in via CI_METRICS_ENABLED on both backends.

Ref strategy

action.yml references SonarSource/gh-action_cache/symlink-keeper@symlink-keeper-1.0.0. The branch symlink-keeper-1.0.0 is pinned at this PR's commit so CI on the PR can resolve the ref. After merge to master, the branch is replaced by a tag of the same name on the same commit (independent of the main v1.x.y cadence).

Test plan

• npm test — all 54 unit tests pass (6 keeper tests now under __tests__/symlink-keeper.test.ts; credential-guard tests slimmed to credential-restore only).
• npm run build — produces the new symlink-keeper/dist/{main,post}/index.js bundles and the rebuilt credential-guard/dist/{main,post}/index.js.
• pre-commit run --all-files — clean.
• In-repo regression: test-s3-cache-survives-git-clean-with-metrics (.github/workflows/test-action.yml) green on this PR — proves symlink-keeper-post recreates .actions/cache-metrics before cache-metrics-post fires after a nested actions/checkout.
• Other regressions green: test-s3-cache-with-credential-interference, test-s3-cache-windows, test-s3-cache-multiple-invocations, test-s3-cache-with-preset-aws-config, test-s3-cache-survives-git-clean — proves the credential-guard revert didn't regress credential restore.
• End-to-end through BUILD-11295 test gh-action_cache@feat/.../BUILD-11295-metricsFeatureFlag ci-github-actions#267 → https://github.com/SonarSource/sonar-dummy/pull/592 (both re-pinned to this branch).

Links

• Jira: https://sonarsource.atlassian.net/browse/BUILD-11417
• Parent epic: https://sonarsource.atlassian.net/browse/BUILD-11068

[sonarqubecloud]

Agentic Analysis: Early Results

Agentic Analysis and Context Augmentation are available on your project. Here are some issues that could have been prevented. Follow the links to learn how to put them into action.

2 issue(s) found across 2 file(s):

Rule	File	Line	Message
typescript:S7785	src/symlink-keeper-main.ts	13	Prefer top-level await over an async function run call.
typescript:S7785	src/symlink-keeper-post.ts	62	Prefer top-level await over an async function run call.

_{Analyzed by SonarQube Agentic Analysis in 4.4 s}

✅ All code review findings resolved.

_{Configure merge blocking}

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Extracts symlink keeper into a dedicated sub-action and enables metrics across all backends via CI_METRICS_ENABLED. No issues found.

✅ 1 resolved

✅ Bug: credential-guard post-if: success() prevents credential restore on failure

📄 credential-guard/action.yml:11
The previous credential-guard/action.yml had post-if: always() (or relied on the node20 action default of always()). This PR changes it to post-if: success(), which means the credential-guard post step will not run when the job fails.

This breaks the S3 cache-save post step and cache-metrics-post, both of which fire in the LIFO post phase and depend on AWS credentials being restored by credential-guard-post. On job failure, the cache won't be saved because credentials aren't available.

The symlink-keeper already correctly uses post-if: always() for the same reason — it must run regardless of job status. The credential-guard should do the same.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[matemoln]

Thanks for creating the improvement ticket! Approving this with BUILD-11445 in mind.