50 – CAG
38%
main: 43%

Ran 16 Jun 2026 08:10PM UTC

Files 72

Run time 2s

Badge

Embed ▾

Committed 16 Jun 2026 12:25PM UTC coverage: 39.522%. Remained the same

Subproject # CAG – dc167fd39003a0eb0015b3fd3c48396d98c60002.50

Build Type

push

github

Committed by

web-flow

Commit Message

Add environment protection for secret access in workflow (#874)

* add env-protection for secret access

* Add environment protection for secret access in reusable-k3d-agent-test workflow

Fixes a security finding: the test job in reusable-k3d-agent-test.yaml
consumed COMPASS_HOST, COMPASS_CLIENT_ID and COMPASS_CLIENT_SECRET without
being tied to a protected GitHub environment, bypassing environment
protection rules.

This reusable workflow is called by both cra-tests.yaml and cra.yaml, so
adding environment: ${{ vars.PROTECTED_ENVIRONMENT }} here covers all
callers. Environment protection must live inside the reusable workflow
itself, as GitHub Actions does not support the environment keyword on
caller jobs that use reusable workflows.

* Use fallback value for PROTECTED_ENVIRONMENT

* check for env explicitly

* remove env fallback and add explicit check in reusable-k3d-agent-test

---------

Co-authored-by: Michał 'Disper' Drzewiecki <michal.drzewiecki@sap.com>

Coverage Stats

1092 of 2763 relevant lines covered (39.52%)

0.43 hits per line

kyma-project / application-connector-manager / dc167fd39003a0eb0015b3fd3c48396d98c60002 / 50 – CAG
38%
main: 43%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job CAG - dc167fd39003a0eb0015b3fd3c48396d98c60002.50

kyma-project / application-connector-manager / dc167fd39003a0eb0015b3fd3c48396d98c60002 / 50 – CAG 38% main: 43%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job CAG - dc167fd39003a0eb0015b3fd3c48396d98c60002.50

kyma-project / application-connector-manager / dc167fd39003a0eb0015b3fd3c48396d98c60002 / 50 – CAG
38%
main: 43%

README BADGES
x