SONARAZDO-575 SubmitReview: Use Vault token#570
SONARAZDO-575 SubmitReview: Use Vault token#570claire-villard-sonarsource merged 1 commit intomasterfrom
Conversation
hashicorp-vault-sonar-prod
Bot
changed the title
SummaryThis PR switches the SubmitReview workflow to fetch the GitHub token from Vault instead of relying on GitHub's native secrets. The token source changes from What reviewers should knowWhat changed: Two related updates to
Why this matters: This standardizes token management across repos by using centralized Vault credentials instead of per-repo GitHub secrets, enabling easier rotation and audit across the 200+ repos being updated. For reviewers:
|
![sonar-review-alpha[bot]](https://avatars.githubusercontent.com/in/3025063?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM! ✅
Clean, minimal change. The resulting SubmitReview.yml is now consistent with RequestReview.yml — same Vault path, same fromJSON expression, same permissions block. The removal of pull-requests: read is correct: that permission only restricts the built-in GITHUB_TOKEN, which is no longer used here.
|
|
2 participants
With the latest automation changes, we need the Vault-based token now. It's the same token as the one in RequestReview.yml file. Please take care of merging this, I have 200+ repos to update.