GHA-184 Add GitHub token for private rspec repository access

[nils-werner-sonarsource]

This pull request enhances the update-rule-metadata GitHub Action by integrating support for securely retrieving and using a GitHub token from Vault for accessing a private rspec repository. It also adds automated tests to verify the correct configuration and usage of Vault secrets and environment variables. Documentation has been updated to reflect these new requirements and dependencies.

Vault Integration and Environment Variable Handling:

• Added retrieval of the development/github/token/{REPO_OWNER_NAME_DASH}-rspec-read token from Vault in the update-rule-metadata/action.yml, mapping it to the GITHUB_TOKEN environment variable for use in the rule-api execution step. [1] [2]

Test with RPG: https://github.com/SonarSource/sonar-rpg/commit/941329c4daa4f966b3dc152857a5b9359c68b952
Proof-of-concept: https://github.com/SonarSource/sonar-rpg/actions/runs/22098525058

[hashicorp-vault-sonar-prod]

GHA-184

[sonarqubecloud]

SonarQube reviewer guide

Summary: Add vault secret retrieval and CI validation for GitHub token used to access private rspec repository.

Review Focus: Verify that the GitHub token vault configuration (new secret path development/github/token/{REPO_OWNER_NAME_DASH}-rspec-read) is correctly wired through the action. Pay special attention to the new vault-and-env-tests job to ensure the grep patterns accurately validate the action.yml structure, and confirm the token is properly passed to the rule-api execution step.

Start review at: update-rule-metadata/action.yml. This is the core configuration file where the vault secret is retrieved and passed to the rule-api execution. The correctness of the secret path and environment variable mapping is critical for the feature to work.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud