BUILD-12598 Update Manage Vault Policy deep link for org-first picker

[julien-carsique-sonarsource]

Summary

Companion fix to port-actions#532: that PR drops manage_vault_policy's direct binding to github_repository in favor of an org-first picker (github_organization + github_repository form fields).

check-sca/action.yml's "Build Manage Vault Policy link" step builds the "grant access" deep link shown on SCA-check failures, using $targetEntity to prefill the bound entity. That key becomes meaningless once port-actions#532 merges — the linked form opens empty instead of prefilled.

Changes

• github_organization prefilled from GITHUB_REPOSITORY_OWNER, github_repository from the org-qualified entity identifier (org/repo), replacing $targetEntity.
• Restored the digit-led JSURL string guard for both new values — GitHub org names can start with a digit (e.g. 1password), which JSURL would otherwise misparse as a number.

Test plan

No existing test coverage exercises this step's JSURL output. Verified the encoding with the jsurl2 library Port's docs point to, end to end including the script's own percent-encoding of (, ), ~:

{"github_organization":"Sonar-Private","github_repository":"Sonar-Private/it-team-test-repo-1","ignore_secrets":true,"current_week":"2026_39","ref":"master","use_sandbox":false}
{"github_organization":"3dcorp","github_repository":"3dcorp/9numeric_repo","ignore_secrets":true,"current_week":"2026_39","ref":"master","use_sandbox":false}

Matches the intended prefill in both cases.

Coordination

Can merge in either order relative to https://github.com/SonarSource/port-actions/pull/532, back-to-back — the link only misses its prefill for the gap between the two merges, no functional or security impact.

[hashicorp-vault-sonar-prod]

BUILD-12598

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · Changes generated Port deep-link inputs and runtime prefill behavior.

Updates the Manage Vault Policy deep link to use org-first picker fields (github_organization and github_repository) with JSURL string guards for both values, including digit-led org names. Resolves the prefill issue once port-actions#532 merges; no functional impact during the interim window.

✅ 2 closed

✅ Bug: Merging before port-actions#532 drops the working repo prefill

📄 check-sca/action.yml:51-54 📄 check-sca/action.yml:66
The description says this PR can safely merge before port-actions#532 because "the old $targetEntity key is simply ignored by the still-entity-bound live action." That has it backwards. This PR removes $targetEntity, which is the only key the live, entity-bound manage_vault_policy action reads. The new github_organization/github_repository keys don't exist on that action yet, so they are the ones that get ignored. If this lands first, the SCA-failure "grant access" link opens with no repository prefilled until #532 is deployed. Either merge only after #532 is live, or keep *StargetEntity~${NAME_J} alongside the new keys during the transition. Port ignores inputs the action doesn't define, so the extra key does no harm.

✅ Edge Case: Digit-led JSURL string guard removed for new string values

📄 check-sca/action.yml:62-64
The old code added a * prefix to digit-led values, because JSURL reads a value that starts with a digit as a number. The new code applies only the _ escape to ORG_J and REPO_ENTITY_J. Both now start with the org name, and GitHub allows org names that start with a digit, so the guard is still needed. For such an org (e.g. 3dcorp), the github_organization and github_repository values would be misparsed or fail to decode, and the form would not prefill. Keep the same case ... [0-9]* guard for both values.

Review coverage

🧪 Functional validation 2 of 2 objectives covered

📋 Rules No rules evaluated

🤖 Auto-approval Not enabled · Set up

Implementation Status ✅ 2 of 2 objectives covered

✅ BUILD-12598 - 2 of 2 objectives covered

This PR covers both objectives by updating the manage vault policy deep link to use the org-first picker pattern with organization and repository fields.

✅ 2 covered here

• ✅ Allow the user to pick the organization first when managing vault policy
• ✅ Restrict the repository selection to only show repositories from the chosen organization when granting or updating Vault secrets

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}