SCANPY-246 SubmitReview: Use Vault token

[pavel-mikula-sonarsource]

With the latest automation changes, we need the Vault-based token now. It's the same token as the one in RequestReview.yml file. Please take care of merging this, I have 200+ repos to update.

[hashicorp-vault-sonar-prod]

SCANPY-246

[sonar-review-alpha]

Summary

Switches the SubmitReview workflow to use a Vault-based GitHub token instead of GitHub's built-in secrets, bringing it into alignment with automation infrastructure changes and the RequestReview workflow. The GitHub token is now retrieved from Vault alongside the existing JIRA credentials, enabling centralized secret management. The pull-requests: read permission is removed as it's no longer needed when using the Vault token.

What reviewers should know

File to review: .github/workflows/SubmitReview.yml

Key change: Line 24 switches the token source from secrets.GITHUB_TOKEN to the Vault-based token extracted in the previous step.

What to verify:

• The Vault path development/github/token/{REPO_OWNER_NAME_DASH}-jira correctly resolves the token name (confirm consistency with RequestReview.yml)
• The token will be available in the Vault instance used by this workflow
• Verify the removed pull-requests: read permission is genuinely unnecessary with the Vault approach (likely true, but worth confirming)

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, minimal change that aligns SubmitReview with the established pattern in RequestReview.yml. The Vault path, variable names, and fromJSON extraction are identical between the two files, and removing pull-requests: read is correct — that permission only governs the built-in GitHub Actions token, which the Vault step doesn't use.

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed for 'Python Scanner'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[Seppli11]

LGTM