BUILD-11835 Guard Vault JSON expressions

[jayadeep-km-sonarsource]

BUILD-11835 Guard Vault JSON expressions

Jira: https://sonarsource.atlassian.net/browse/BUILD-11835

Guard all remaining fromJSON(steps.secrets.outputs.vault) expressions in composite actions. Empty Vault output now short-circuits to an empty value instead of producing a JToken parsing error during post-job evaluation.

Coverage:

• Guards config-gradle Develocity access-key parsing.
• Guards build-gradle secret environment values.
• Audits and guards all remaining expressions against this Vault output across 12 action files.

Validation:

• mise exec -- pre-commit run yamllint --files <12 changed action files>
• git diff origin/master...HEAD --check
• sonar analyze --base origin/master --format json (0 issues, 0 failures)
• sonar analyze secrets <12 changed action files> (no issues)
• ./run_shell_tests.sh requires unavailable kcov; direct ShellSpec run reported two failures that CI must confirm.
• Sonar context augmentation: unavailable (Vortex Context is not installed).

Caveats: No GitHub Actions post-job simulation harness exists locally.

This draft PR was opened by the autonomous factory. A human must mark it ready, approve it, and merge it.

[hashicorp-vault-sonar-prod]

BUILD-11835

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

Guards all remaining fromJSON(steps.secrets.outputs.vault) expressions in composite actions to prevent JToken parsing errors when Vault output is empty. Vault guard audit across 12 action files was completed, addressing artifactory expressions in 2 actions.

✅ 1 closed

✅ Bug: Vault guard audit misses artifactory expressions in 2 actions

📄 build-yarn/action.yml:167-169 📄 promote/action.yml:72
The audit that this PR claims covers "all remaining expressions against this Vault output" left fromJSON(steps.artifactory.outputs.vault) unguarded in build-yarn/action.yml:167-169 and promote/action.yml:71 — both in env: blocks the PR otherwise rewrote line-for-line, and both the last such sites in the repo (build-gradle, build-maven, build-npm, build-poetry, config-gradle and config-maven all already use the steps.artifactory.outputs.vault && … || '' form). With an empty Vault output these two actions still hit the JToken parse error this PR exists to remove. Note the guarded replacements exceed the 140-char yamllint limit, so use a folded continuation as update-release-channel does; the four .github/workflows/*Review*.yml / PullRequest*.yml files also still hold unguarded fromJSON(steps.secrets.outputs.vault) expressions, which the description's "composite actions" wording may intentionally exclude.

Review coverage

Functional validation 3 of 4 objectives covered

Rules No rules evaluated

Auto-approval Not enabled · Set up

Implementation Status ◻️ 3 of 4 objectives covered

◻️ BUILD-11835 - 3 of 4 objectives covered

This PR covers guarding the vault JSON expressions in config-gradle and build-gradle actions.

Other objectives on this issue, possibly covered elsewhere:

• ◻️ Validate that post-job cleanup no longer surfaces misleading JToken errors when vault output is empty

✅ 3 covered here

• ✅ Guard config-gradle develocity-access-key with steps.secrets.outputs.vault && before fromJSON
• ✅ Guard build-gradle vault secret env expressions using the same pattern as Artifactory secrets in the same file
• ✅ Audit and fix remaining unguarded fromJSON(steps.secrets.outputs.vault) calls in ci-github-actions

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud