T

Joseph SpikerandClaude Opus 4.8 db71896903 feat: add bao-secrets composite action (public, no secrets) (#545 )

Shared actions live in a PUBLIC repo so CI runners can clone them anonymously.
They can't clone the private spikersoft-infrastructure repo (a job token is
scoped to its own repo), which is why the notifications Bao cutover failed with
"Repository not found". bao-secrets is pure curl/jq logic — role_id/secret_id
come from the caller's Actions secrets — so nothing sensitive is exposed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-15 15:50:44 +00:00

bao-secrets

feat: add bao-secrets composite action (public, no secrets) (#545 )

2026-07-15 15:50:44 +00:00

README.md

feat: add bao-secrets composite action (public, no secrets) (#545 )

2026-07-15 15:50:44 +00:00

README.md

gitea-actions

Shared public Gitea Actions composite actions for the SpikerSoft org.

Public on purpose: these contain only workflow logic (shell/curl/jq), never secrets. Runners can clone this repo anonymously, which is why shared actions live here instead of the private spikersoft-infrastructure repo (a private repo can't be cloned by a job token scoped to a different repo).

Actions

bao-secrets — AppRole-login to OpenBao and export requested KV v2 secrets into the job env (masked). Phase 1, spikersoft-issues#545.

- uses: https://git.spikersoft.com/spikerj/gitea-actions/bao-secrets@master
  with:
    role-id:   ${{ secrets.BAO_ROLE_ID }}
    secret-id: ${{ secrets.BAO_SECRET_ID }}
    secrets: |
      DOCKER_PASSWORD  secret/ci/shared/registry  password

Reference by full URL (https://git.spikersoft.com/...) so Gitea resolves it from this instance instead of github.com.