T

Joseph SpikerandClaude Opus 4.8 a67d0cf3f3 fix(bao-secrets): retry login+fetch with backoff on 429/504/non-JSON (#545/#590-adjacent)

Under a CI burst (a batch merge fires ~13 workflows x ~4 jobs, each doing an
AppRole login = a raft write), the vault nodes return nginx 504s and the
rate-limit quota returns 429s. Both are non-JSON, which crashed jq and
hard-failed the job with a misleading "parse error". Add a bao_req helper that
retries connect-failures/429/5xx with backoff+jitter (~60s over 6 tries) and
surfaces real 4xx bodies unchanged. Transient throttling no longer fails CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 16:57:25 +00:00

bao-secrets

fix(bao-secrets): retry login+fetch with backoff on 429/504/non-JSON (#545/#590-adjacent)

2026-07-15 16:57:25 +00:00

README.md

feat: add bao-secrets composite action (public, no secrets) (#545 )

2026-07-15 15:50:44 +00:00

README.md

gitea-actions

Shared public Gitea Actions composite actions for the SpikerSoft org.

Public on purpose: these contain only workflow logic (shell/curl/jq), never secrets. Runners can clone this repo anonymously, which is why shared actions live here instead of the private spikersoft-infrastructure repo (a private repo can't be cloned by a job token scoped to a different repo).

Actions

bao-secrets — AppRole-login to OpenBao and export requested KV v2 secrets into the job env (masked). Phase 1, spikersoft-issues#545.

- uses: https://git.spikersoft.com/spikerj/gitea-actions/bao-secrets@master
  with:
    role-id:   ${{ secrets.BAO_ROLE_ID }}
    secret-id: ${{ secrets.BAO_SECRET_ID }}
    secrets: |
      DOCKER_PASSWORD  secret/ci/shared/registry  password

Reference by full URL (https://git.spikersoft.com/...) so Gitea resolves it from this instance instead of github.com.