[Security Solution][Alerts Table] support bulk selection for run workflow action

[kelvtanv]

Summary

See issue

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

[Copilot]

Pull request overview

Adds bulk-selection support for “Run workflow” in the Security Solution alerts table, enabling users to execute workflows against multiple selected alerts.

Changes:

• Introduces a new bulk actions hook that registers the “Run workflow” bulk action item and its content panel.
• Refactors AlertWorkflowsPanel to accept an alertIds array (supporting both single and bulk execution) and a generic onClose callback.
• Wires the new bulk “Run workflow” action into the existing bulk actions composition.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
x-pack/solutions/security/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_bulk_run_alert_workflow_panel.tsx	Adds a hook that supplies bulk “Run workflow” action items/panels and renders the workflow panel for selected alerts.
x-pack/solutions/security/plugins/security_solution/public/detections/hooks/trigger_actions_alert_table/use_bulk_actions.tsx	Integrates the new bulk “Run workflow” items/panels into the bulk actions list.
x-pack/solutions/security/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_run_alert_workflow_panel.tsx	Refactors the workflow panel API to support bulk alert IDs and updates the single-alert workflow panel usage accordingly.

[Copilot]

_index is being defaulted to an empty string when missing. If the workflow trigger expects a valid {_id, _index} pair, sending '' can cause execution failures or incorrect behavior. Prefer filtering out items without _index (and optionally showing a toast), or change the alertId type/payload to allow an optional _index and handle that case explicitly before calling runWorkflow.

Suggested change

	const alertIds = props.alertItems.map((item) => ({
	_id: item._id,
	_index: item._index ?? '',
	}));
	const alertIds = props.alertItems
	.filter((item) => Boolean(item._index))
	.map((item) => ({
	_id: item._id,
	_index: item._index!,
	}));

[Copilot]

AlertWorkflowAlertId requires _index: string, but callers are currently constructing _index values via ?? '' (i.e., potentially passing an empty string). This weakens the contract and makes it unclear whether _index is truly required. Consider either (a) making _index optional in the type and handling missing values before mutation, or (b) enforcing non-empty _index at the call sites (e.g., filter/guard and surface a user-facing error).

Suggested change

	_index: string;
	_index?: string;

[Copilot]

The enablement condition hasIndexWrite && workflowUIEnabled && canExecuteWorkflow is duplicated across both memos. Consider extracting a single isRunWorkflowEnabled boolean (memoized or derived) and using it in both places to reduce duplication and prevent future drift between item/panel gating logic.