xworkspace-console

History

Haitao Pan 75d3098d1c ci(deploy-iac): fetch secrets from Vault KV via GitHub OIDC Replace GitHub Actions Secrets with HashiCorp Vault (https://vault.svc.plus): - permissions: id-token: write; auth via hashicorp/vault-action@v2 (method=jwt, role=github-actions-xworkspace-console, audience=vault) — no static token. - Each job loads only the keys it needs from kv/data/github-actions/xworkspace-console (VULTR_API_KEY, INFRA_REPO_TOKEN, ANSIBLE_SSH_KEY, CLOUDFLARE_API_TOKEN, DEEPSEEK/NVIDIA/OLLAMA_API_KEY, optional TF_STATE_*). - Backend gating now keys off the Vault output (steps.vault.outputs.TF_STATE_BUCKET). - Drop unused 'playbook' input (deploy is on-host bootstrap). Pattern mirrors xworkmate-app/.github/workflows/build-and-release.yml. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-24 15:17:46 +08:00
..
workflows	ci(deploy-iac): fetch secrets from Vault KV via GitHub OIDC	2026-06-24 15:17:46 +08:00

Haitao Pan 75d3098d1c ci(deploy-iac): fetch secrets from Vault KV via GitHub OIDC

Replace GitHub Actions Secrets with HashiCorp Vault (https://vault.svc.plus):
- permissions: id-token: write; auth via hashicorp/vault-action@v2 (method=jwt,
  role=github-actions-xworkspace-console, audience=vault) — no static token.
- Each job loads only the keys it needs from kv/data/github-actions/xworkspace-console
  (VULTR_API_KEY, INFRA_REPO_TOKEN, ANSIBLE_SSH_KEY, CLOUDFLARE_API_TOKEN,
  DEEPSEEK/NVIDIA/OLLAMA_API_KEY, optional TF_STATE_*).
- Backend gating now keys off the Vault output (steps.vault.outputs.TF_STATE_BUCKET).
- Drop unused 'playbook' input (deploy is on-host bootstrap).

Pattern mirrors xworkmate-app/.github/workflows/build-and-release.yml.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-24 15:17:46 +08:00

workflows

ci(deploy-iac): fetch secrets from Vault KV via GitHub OIDC

2026-06-24 15:17:46 +08:00