From b49e7a92840f1cd9460d47da77c82eb56afa4062 Mon Sep 17 00:00:00 2001
From: Julien Carsique <julien.carsique@sonarsource.com>
Date: Tue, 22 Sep 2026 16:59:47 +0200
Subject: [PATCH] BUILD-12598 Update Manage Vault Policy deep link for
 org-first picker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

manage_vault_policy is dropping its direct binding to the
github_repository blueprint in favor of an org-first picker
(github_organization + github_repository form fields) — see
SonarSource/port-actions#532. The $targetEntity deep-link key this
action's check-sca step relies on to prefill the "grant access" link
on SCA-check failures becomes meaningless once that binding is
dropped, leaving the linked form empty.

Prefill the two new fields instead: github_organization from
GITHUB_REPOSITORY_OWNER, github_repository from the org-qualified
entity identifier (org/repo, matching Port's github_repository
entity identifier convention).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 check-sca/action.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/check-sca/action.yml b/check-sca/action.yml
index afb3b74d..b1d06579 100644
--- a/check-sca/action.yml
+++ b/check-sca/action.yml
@@ -48,16 +48,20 @@ runs:
       shell: bash
       # yamllint disable rule:line-length
       run: |
-        # Port self-service deep link with this repo prefilled. actionInputs uses
-        # Port's JSURL encoding; ignore_secrets=true pre-selects the auth-only fix
-        # (adds auth.github, no kv_paths); current_week mirrors the action's
+        # Port self-service deep link with this repo prefilled via the
+        # github_organization/github_repository fields. actionInputs uses Port's
+        # JSURL encoding; ignore_secrets=true pre-selects the auth-only fix (adds
+        # auth.github, no kv_paths); current_week mirrors the action's
         # default_jq_query (now | strftime("%Y_%V")).
         NAME="${GITHUB_REPOSITORY##*/}"
+        ORG="${GITHUB_REPOSITORY_OWNER}"
+        REPO_ENTITY="${ORG}/${NAME}"
         WEEK="$(date -u +%Y_%V)"
         # jsurl-escape '_' -> '*_'; prefix '*' to force string for digit-led values
-        NAME_J="${NAME//_/*_}"; case "$NAME" in [0-9]*) NAME_J="*${NAME_J}" ;; esac
+        ORG_J="${ORG//_/*_}"; case "$ORG" in [0-9]*) ORG_J="*${ORG_J}" ;; esac
+        REPO_ENTITY_J="${REPO_ENTITY//_/*_}"; case "$REPO_ENTITY" in [0-9]*) REPO_ENTITY_J="*${REPO_ENTITY_J}" ;; esac
         WEEK_J="*${WEEK//_/*_}"
-        INPUTS="(*StargetEntity~${NAME_J}~ignore*_secrets~_T~current*_week~${WEEK_J}~ref~master~use*_sandbox~_F)~"
+        INPUTS="(github*_organization~${ORG_J}~github*_repository~${REPO_ENTITY_J}~ignore*_secrets~_T~current*_week~${WEEK_J}~ref~master~use*_sandbox~_F)~"
         INPUTS="${INPUTS//(/%28}"; INPUTS="${INPUTS//)/%29}"; INPUTS="${INPUTS//\~/%7E}"
         echo "url=https://app.getport.io/org_FnpuoXpSHY1JC3yg/self-serve?action=manage_vault_policy&actionInputs=${INPUTS}" >> "$GITHUB_OUTPUT"
       # yamllint enable rule:line-length