PREQ-6823 Guard Develocity vault JSON parsing in config-gradle

[marta-sancheztorres-sonarsource]

Summary

Guard config-gradle's develocity-access-key expression so GitHub Actions does not call fromJSON(...) when the Vault output is empty during post-job evaluation.

Context

sonarcloud-analyzers-shared-services PR 314 (SC-51120) is migrating the repository to uv and currently uses build-gradle@v1 with Develocity enabled in several jobs.

The current config-gradle action evaluates:

develocity-access-key: ${{ inputs.use-develocity == 'true' &&
  fromJSON(steps.secrets.outputs.vault).DEVELOCITY_TOKEN || '' }}

During Post job cleanup, steps.secrets.outputs.vault can be empty/unavailable, which causes:

Error reading JToken from JsonReader

This change makes the expression consistent with the already-safe DEVELOCITY_TOKEN environment export earlier in the same action.

Change

develocity-access-key: ${{ inputs.use-develocity == 'true' && steps.secrets.outputs.vault &&
  fromJSON(steps.secrets.outputs.vault).DEVELOCITY_TOKEN || '' }}

Impact

This is the shared-action fix needed to unblock completion of SC-51120 without keeping a repo-specific workaround in sonarcloud-analyzers-shared-services.

Validation

• git diff --check
• ./run_shell_tests.sh could not be run locally because shellspec is not installed in the current environment

[hashicorp-vault-sonar-prod]

PREQ-6823

[gitar-bot]

Code Review ✅ Approved

Adds a conditional check to the Develocity access key expression to prevent fromJSON errors when Vault output is empty during post-job evaluation. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud