RUST-139 SubmitReview: Use Vault token

[pavel-mikula-sonarsource]

With the latest automation changes, we need the Vault-based token now. It's the same token as the one in RequestReview.yml file. Please take care of merging this, I have 200+ repos to update.

[hashicorp-vault-sonar-prod]

RUST-139

[sonar-review-alpha]

Summary

This PR migrates the SubmitReview workflow to retrieve the GitHub token from Vault instead of relying on a repository secret. A new secret fetch step retrieves GITHUB_TOKEN from Vault's development environment, and the SubmitReview action now uses this Vault-sourced token. The pull-requests: read permission is removed as it's no longer required.

This brings SubmitReview.yml in line with the RequestReview.yml pattern and is part of standardizing token management across 200+ repositories.

What reviewers should know

Key changes:

• The secrets step now retrieves GITHUB_TOKEN from Vault alongside JIRA_USER and JIRA_TOKEN
• The github-token input switched from secrets.GITHUB_TOKEN (repo secret) to the Vault output
• pull-requests: read permission removed — verify this is safe given the new token source

For reviewers:
Start by confirming the Vault path (development/github/token/{REPO_OWNER_NAME_DASH}-jira) exists and is configured correctly. The token itself should be the same; only the retrieval method changed. Check that the fromJSON() parsing matches the vault-action-wrapper output format.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

This PR correctly aligns SubmitReview.yml with the already-updated RequestReview.yml. The Vault path, fromJSON expression syntax, token field name, and permissions block are now identical between the two files. {REPO_OWNER_NAME_DASH} is a Vault-native template variable resolved at runtime by vault-action-wrapper — not an unsubstituted placeholder. Removing pull-requests: read is correct; RequestReview.yml never needed it either, as the Vault-issued token carries its own GitHub App permissions.

🗣️ Give feedback

[sebastien-marichal]

LGTM!

[sonarqube-next]

Quality Gate passed for 'sonar-rust'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube