SCANCLI-220 SubmitReview: Use Vault token

[pavel-mikula-sonarsource]

With the latest automation changes, we need the Vault-based token now. It's the same token as the one in RequestReview.yml file. Please take care of merging this, I have 200+ repos to update.

[hashicorp-vault-sonar-prod]

SCANCLI-220

[sonar-review-alpha]

Summary

What changed: The SubmitReview workflow now retrieves the GitHub token from Vault instead of using the default secrets.GITHUB_TOKEN, aligning it with the RequestReview workflow pattern. The change includes fetching a Vault-managed token via vault-action-wrapper and passing it to the SubmitReview action.

Why: This migration to Vault-based token management is part of the latest automation changes. It enables centralized token management and consistency across workflows. The same token is already used in RequestReview.yml.

What reviewers should know

What to review:

• The new Vault secret path: development/github/token/{REPO_OWNER_NAME_DASH}-jira token — verify the path syntax is correct and matches your Vault configuration
• The token is extracted from the vault output and passed to the action: fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN
• Removed pull-requests: read permission — no longer needed since we're not using default GitHub token credentials

Context: This is one of 200+ repos being updated to this pattern. The changes are minimal and follow the RequestReview.yml pattern, so if that workflow is working correctly, this should work the same way.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, minimal change. The resulting SubmitReview.yml is now structurally identical to RequestReview.yml, which already uses this same Vault token pattern successfully. The removal of pull-requests: read is correct — that permission scoped the built-in GITHUB_TOKEN; the Vault-managed token carries its own permissions and doesn't need it.

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube