ci: load deploy secrets from openbao

scripts/README.md

@@ -37,3 +37,19 @@ Usage:
 ```bash
 ./scripts/staging-note-block.sh rmcp.itexp.me abc1234 "codex + operator" partial
 ```
+
+## load-openbao-env.sh
+
+Loads one OpenBao KV secret into a local shell env file.
+
+Required environment variables:
+
+- `BAO_ADDR`
+- `BAO_TOKEN`
+- `BAO_SECRET_PATH`
+
+Optional environment variables:
+
+- `OPENBAO_ENV_FILE`, defaults to `.openbao-env`
+
+The script supports both KV v1 and KV v2 response shapes.

scripts/load-openbao-env.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${BAO_ADDR:?BAO_ADDR is required}"
+: "${BAO_TOKEN:?BAO_TOKEN is required}"
+: "${BAO_SECRET_PATH:?BAO_SECRET_PATH is required}"
+
+output="${OPENBAO_ENV_FILE:-.openbao-env}"
+payload="$(mktemp)"
+trap 'rm -f "$payload"' EXIT
+
+curl --fail --silent --show-error \
+  --header "X-Vault-Token: ${BAO_TOKEN}" \
+  "${BAO_ADDR%/}/v1/${BAO_SECRET_PATH#/}" \
+  > "$payload"
+
+python3 - "$payload" "$output" <<'PY'
+import json
+import re
+import shlex
+import sys
+from pathlib import Path
+
+payload_path = Path(sys.argv[1])
+output_path = Path(sys.argv[2])
+
+payload = json.loads(payload_path.read_text(encoding="utf-8"))
+data = payload.get("data", {})
+
+if isinstance(data, dict) and isinstance(data.get("data"), dict):
+    data = data["data"]
+
+if not isinstance(data, dict):
+    raise SystemExit("OpenBao response does not contain an object secret payload")
+
+name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+lines = [
+    "# Generated by scripts/load-openbao-env.sh",
+    "# Do not commit this file.",
+]
+
+for key in sorted(data):
+    if not name_re.match(key):
+        raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
+    value = data[key]
+    if value is None:
+        continue
+    if isinstance(value, bool):
+        value = "true" if value else "false"
+    elif not isinstance(value, str):
+        value = str(value)
+    lines.append(f"export {key}={shlex.quote(value)}")
+
+output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+output_path.chmod(0o600)
+print(f"Loaded {len(lines) - 2} OpenBao values into {output_path}", file=sys.stderr)
+PY