BUILD-11405: Changes the environment tag associated with the SCA Check

[bwalsh434]

Context

Follow-up ticket from PREQ-5827 and #259 , which fixed the OIDC issue, but associated the check-sca check with every dev deployment (example in slack).

What Changed?

• We fix the above stated issue by changing the environment value to something completely unique here, environment: sca-checking

[hashicorp-vault-sonar-prod]

BUILD-11405

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Summary

This PR fixes an unintended side effect from PR #259 by changing the GitHub Actions workflow's environment value from dev to sca-checking.

The previous use of dev caused the SCA check job to be associated with all dev deployments in GitHub, when it should only run as a pre-merge security check. Using a unique environment identifier prevents unwanted triggering on deployment events.

What reviewers should know

What to review:

• The single-line change in .github/workflows/check-sca.yml (environment field)
• Verify the new environment name sca-checking is unique enough to avoid future conflicts

Context:

• This is a GitHub Actions environment configuration used for OIDC token claims (see inline comment)
• The environment value doesn't affect the check's functionality, only GitHub's event associations
• No new credentials or permissions needed — the environment just needs to exist in the repository settings (may already be auto-created by GitHub)

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[Copilot]

Pull request overview

This PR updates the SCA check workflow so its OIDC environment claim no longer uses dev, avoiding accidental association with development deployments while still satisfying Vault’s required environment claim.

Changes:

• Replaces environment: dev with environment: sca-checking.
• Updates the inline comment to explain the dedicated environment value.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonar-review-alpha]

LGTM! ✅

🗣️ Give feedback