fix: preserve secret file mapping INF-177

[chriszhao1988]

Incident follow-up

Datacenter development CD reached the reusable deployment workflow but failed before reading mapped JWT fields.

Root cause

The workflow piped the JSON mapping through jq type validation and redirected jq's boolean result into the mapping file. Later mapping iteration therefore received true instead of the JSON object.

Change

Write the original mapping JSON to the protected temporary mapping file, then validate that file separately as an object.

Validation

• Workflow YAML parsed successfully.
• A synthetic fixture exercised the exact write, validation, and lookup path; both JWT mapping entries remained available.
• No Secrets Manager value or PEM content was read, logged, or committed.

Rollout

Merge this PR first. A new Datacenter develop push is then required to resolve the updated reusable workflow ref and retry deployment.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a1f6bd2-479a-4055-8a8d-fa32f1165959

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}