56 – CRA
38%
main: 43%

Ran 18 Jun 2026 06:10AM UTC

Files 87

Run time 2s

Badge

Embed ▾

Committed 16 Jun 2026 12:25PM UTC coverage: 46.31%. Remained the same

Subproject # CRA – dc167fd39003a0eb0015b3fd3c48396d98c60002.56

Build Type

push

github

Committed by

web-flow

Commit Message

Add environment protection for secret access in workflow (#874)

* add env-protection for secret access

* Add environment protection for secret access in reusable-k3d-agent-test workflow

Fixes a security finding: the test job in reusable-k3d-agent-test.yaml
consumed COMPASS_HOST, COMPASS_CLIENT_ID and COMPASS_CLIENT_SECRET without
being tied to a protected GitHub environment, bypassing environment
protection rules.

This reusable workflow is called by both cra-tests.yaml and cra.yaml, so
adding environment: ${{ vars.PROTECTED_ENVIRONMENT }} here covers all
callers. Environment protection must live inside the reusable workflow
itself, as GitHub Actions does not support the environment keyword on
caller jobs that use reusable workflows.

* Use fallback value for PROTECTED_ENVIRONMENT

* check for env explicitly

* remove env fallback and add explicit check in reusable-k3d-agent-test

---------

Co-authored-by: Michał 'Disper' Drzewiecki <michal.drzewiecki@sap.com>

Coverage Stats

2190 of 4729 relevant lines covered (46.31%)

0.51 hits per line

kyma-project / application-connector-manager / dc167fd39003a0eb0015b3fd3c48396d98c60002 / 56 – CRA
38%
main: 43%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job CRA - dc167fd39003a0eb0015b3fd3c48396d98c60002.56

kyma-project / application-connector-manager / dc167fd39003a0eb0015b3fd3c48396d98c60002 / 56 – CRA 38% main: 43%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job CRA - dc167fd39003a0eb0015b3fd3c48396d98c60002.56

kyma-project / application-connector-manager / dc167fd39003a0eb0015b3fd3c48396d98c60002 / 56 – CRA
38%
main: 43%

README BADGES
x