ci: switch openbao loading to approle

scripts/README.md

@@ -40,16 +40,25 @@ Usage:
 
 ## load-openbao-env.sh
 
-Loads one OpenBao KV secret into a local shell env file.
+Logs in to OpenBao with AppRole and loads Community deploy/runtime secrets into a local shell env file.
 
 Required environment variables:
 
 - `BAO_ADDR`
-- `BAO_TOKEN`
-- `BAO_SECRET_PATH`
+- `BAO_ROLE_ID`
+- `BAO_SECRET_ID`
+- `OPENBAO_APP`
 
 Optional environment variables:
 
 - `OPENBAO_ENV_FILE`, defaults to `.openbao-env`
 
-The script supports both KV v1 and KV v2 response shapes.
+The script reads KV v2 secrets from mount `ci`:
+
+- `shared/registry`
+- `shared/deploy-ssh`
+- `projects/${OPENBAO_APP}/deploy`
+- `projects/${OPENBAO_APP}/runtime`
+
+It also exposes `REGISTRY_USERNAME` and `REGISTRY_PASSWORD` as the workflow-compatible
+aliases `DEPLOY_REGISTRY_USER` and `DEPLOY_REGISTRY_TOKEN`.

scripts/load-openbao-env.sh

@@ -2,36 +2,67 @@
 set -euo pipefail
 
 : "${BAO_ADDR:?BAO_ADDR is required}"
-: "${BAO_TOKEN:?BAO_TOKEN is required}"
-: "${BAO_SECRET_PATH:?BAO_SECRET_PATH is required}"
+: "${BAO_ROLE_ID:?BAO_ROLE_ID is required}"
+: "${BAO_SECRET_ID:?BAO_SECRET_ID is required}"
+: "${OPENBAO_APP:?OPENBAO_APP is required}"
 
 output="${OPENBAO_ENV_FILE:-.openbao-env}"
 payload="$(mktemp)"
-trap 'rm -f "$payload"' EXIT
+merged="$(mktemp)"
+trap 'rm -f "$payload" "$merged"' EXIT
 
-curl --fail --silent --show-error \
-  --header "X-Vault-Token: ${BAO_TOKEN}" \
-  "${BAO_ADDR%/}/v1/${BAO_SECRET_PATH#/}" \
-  > "$payload"
+export BAO_ADDR
+BAO_TOKEN="$(bao write -field=token auth/approle/login role_id="$BAO_ROLE_ID" secret_id="$BAO_SECRET_ID")"
+export BAO_TOKEN
 
-python3 - "$payload" "$output" <<'PY'
+printf '{}\n' > "$merged"
+
+merge_secret() {
+  local path="$1"
+
+  bao kv get -mount=ci -format=json "$path" > "$payload"
+
+  python3 - "$payload" "$merged" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+merged_path = Path(sys.argv[2])
+merged = json.loads(merged_path.read_text(encoding="utf-8"))
+
+data = payload.get("data", {})
+if isinstance(data, dict) and isinstance(data.get("data"), dict):
+    data = data["data"]
+
+if not isinstance(data, dict):
+    raise SystemExit("OpenBao response does not contain an object secret payload")
+
+merged.update({key: value for key, value in data.items() if value is not None})
+merged_path.write_text(json.dumps(merged), encoding="utf-8")
+PY
+}
+
+merge_secret "shared/registry"
+merge_secret "shared/deploy-ssh"
+merge_secret "projects/${OPENBAO_APP}/deploy"
+merge_secret "projects/${OPENBAO_APP}/runtime"
+
+python3 - "$merged" "$output" <<'PY'
 import json
 import re
 import shlex
 import sys
 from pathlib import Path
 
-payload_path = Path(sys.argv[1])
+data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
 output_path = Path(sys.argv[2])
 
-payload = json.loads(payload_path.read_text(encoding="utf-8"))
-data = payload.get("data", {})
+if "REGISTRY_USERNAME" in data and "DEPLOY_REGISTRY_USER" not in data:
+    data["DEPLOY_REGISTRY_USER"] = data["REGISTRY_USERNAME"]
 
-if isinstance(data, dict) and isinstance(data.get("data"), dict):
-    data = data["data"]
-
-if not isinstance(data, dict):
-    raise SystemExit("OpenBao response does not contain an object secret payload")
+if "REGISTRY_PASSWORD" in data and "DEPLOY_REGISTRY_TOKEN" not in data:
+    data["DEPLOY_REGISTRY_TOKEN"] = data["REGISTRY_PASSWORD"]
 
 name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 lines = [
@@ -43,8 +74,6 @@ for key in sorted(data):
     if not name_re.match(key):
         raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
     value = data[key]
-    if value is None:
-        continue
     if isinstance(value, bool):
         value = "true" if value else "false"
     elif not isinstance(value, str):