JAVASE-199 SubmitReview: Use Vault token

[pavel-mikula-sonarsource]

With the latest automation changes, we need the Vault-based token now. It's the same token as the one in RequestReview.yml file. Please take care of merging this, I have 200+ repos to update.

[hashicorp-vault-sonar-prod]

JAVASE-199

[sonar-review-alpha]

Summary

This PR updates the SubmitReview GitHub workflow to fetch the GitHub token from Vault instead of using a static repository secret. The change replaces the plain secrets.GITHUB_TOKEN reference with a dynamically fetched token retrieved from the Vault service during workflow execution.

What changed:

• Added Vault secret retrieval for GITHUB_TOKEN via development/github/token/{REPO_OWNER_NAME_DASH}-jira
• Updated the github-token input to the SubmitReview action to use the Vault-fetched token
• Removed the pull-requests: read permission (no longer needed with Vault-based token)

This aligns the workflow with the same pattern already used in RequestReview.yml, providing more secure token management across the CI/CD automation.

What reviewers should know

Key points for review:

1. Token source change — Line 25 adds the Vault secret retrieval. Verify the secret path development/github/token/{REPO_OWNER_NAME_DASH}-jira is correct and matches what's used in RequestReview.yml
2. Action input update — Line 29 changes from ${{secrets.GITHUB_TOKEN}} to ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}, ensuring the Vault-fetched token is used
3. Permission removal — pull-requests: read is safe to remove since the Vault token has the necessary permissions
4. Scale consideration — The author mentions 200+ repos need this same change, so ensure this pattern is the standard to roll out elsewhere

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, correct change. The updated pattern (Vault secret path, fromJSON output parsing, no pull-requests: read permission) is identical to what RequestReview.yml and PullRequestCreated.yml already use — this PR simply brings SubmitReview.yml into alignment with the established convention.

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[rombirli]

LGTM