Joseph SpikerandClaude Opus 4.8
db71896903
Shared actions live in a PUBLIC repo so CI runners can clone them anonymously. They can't clone the private spikersoft-infrastructure repo (a job token is scoped to its own repo), which is why the notifications Bao cutover failed with "Repository not found". bao-secrets is pure curl/jq logic — role_id/secret_id come from the caller's Actions secrets — so nothing sensitive is exposed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
26 lines
940 B
Markdown
26 lines
940 B
Markdown
# gitea-actions
|
|
|
|
Shared **public** Gitea Actions composite actions for the SpikerSoft org.
|
|
|
|
Public on purpose: these contain only workflow *logic* (shell/curl/jq), never
|
|
secrets. Runners can clone this repo anonymously, which is why shared actions
|
|
live here instead of the private `spikersoft-infrastructure` repo (a private
|
|
repo can't be cloned by a job token scoped to a different repo).
|
|
|
|
## Actions
|
|
|
|
- **bao-secrets** — AppRole-login to OpenBao and export requested KV v2 secrets
|
|
into the job env (masked). Phase 1, spikersoft-issues#545.
|
|
|
|
```yaml
|
|
- uses: https://git.spikersoft.com/spikerj/gitea-actions/bao-secrets@master
|
|
with:
|
|
role-id: ${{ secrets.BAO_ROLE_ID }}
|
|
secret-id: ${{ secrets.BAO_SECRET_ID }}
|
|
secrets: |
|
|
DOCKER_PASSWORD secret/ci/shared/registry password
|
|
```
|
|
|
|
Reference by full URL (`https://git.spikersoft.com/...`) so Gitea resolves it
|
|
from this instance instead of github.com.
|