SCANDOCKER-77 SubmitReview: Use Vault token

[pavel-mikula-sonarsource]

With the latest automation changes, we need the Vault-based token now. It's the same token as the one in RequestReview.yml file. Please take care of merging this, I have 200+ repos to update.

[hashicorp-vault-sonar-prod]

SCANDOCKER-77

[sonar-review-alpha]

Summary

Migrates the GitHub token source in the SubmitReview workflow from GitHub's native secrets to HashiCorp Vault. The workflow now retrieves a Vault-based token (matching the pattern used in RequestReview.yml) and passes it to the SubmitReview action. The pull-requests: read permission was also removed since token scoping is now handled by Vault.

What reviewers should know

Key Changes

• GitHub token now comes from Vault (development/github/token/{REPO_OWNER_NAME_DASH}-jira) instead of secrets.GITHUB_TOKEN
• The token is extracted from the steps.secrets.outputs.vault JSON object in the SubmitReview step
• Removed pull-requests: read from permissions (token scoping is managed by Vault)

For Reviewers

• This mirrors the token retrieval pattern already used in RequestReview.yml
• Verify the Vault secret path exists and has appropriate permissions
• The {REPO_OWNER_NAME_DASH} placeholder should be replaced with the actual repo owner name during deployment

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, minimal change that aligns SubmitReview.yml with the pattern already established in RequestReview.yml. The final state of the two files is now structurally identical (same Vault paths, same token extraction, same permission set). No issues found.

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube