Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: SonarSource/vault-action-wrapper
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 3.2.0
Choose a base ref
...
head repository: SonarSource/vault-action-wrapper
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 3.3.0
Choose a head ref
  • 1 commit
  • 2 files changed
  • 1 contributor

Commits on Mar 4, 2026

  1. PREQ-4481: Diagnose which secret path causes 403 Forbidden failures (#71 

    )

* PREQ-4481: Add per-secret diagnostics on 403 Vault failures

When vault-action fails with a 403 Forbidden, automatically diagnose
which specific secret path(s) are denied by checking per-path
capabilities via Vault's sys/capabilities-self endpoint.

This avoids generating dynamic secrets as a side effect and only
runs on failure, so there is zero overhead on successful runs.

* PREQ-4481: Fix OIDC audience - use default like hashicorp/vault-action

The diagnostic step was failing with "invalid audience (aud) claim" because
we passed vaultUrl as the audience. hashicorp/vault-action uses getIDToken()
without an audience when jwtGithubAudience is not set. Use the same to match
Vault's expected bound_audiences.

* Fix yamllint: comment spacing, line length

* Apply PR feedback: use paths array, batch capabilities-self request

- Vault API expects paths (array) not path (string) for sys/capabilities-self
- Batch all secret paths in a single request to reduce Vault load
- Parse response: data[path] for each path, fallback to data.capabilities for single-path
    @tomverin
    tomverin authored Mar 4, 2026
    Configuration menu
    Copy the full SHA
    3d5c87c View commit details
    Browse the repository at this point in the history
Loading