From ef4d29d1adcaa25b11908882e5a1322402b6c968 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 23 Aug 2026 22:37:12 +1000
Subject: [PATCH] ci: fetch vault from artifactapi instead of dnf install

dnf install reads metadata for every enabled repo and downloads the
vendored vault RPM on every pipeline run. Fetch the pinned upstream zip
from the artifactapi hashicorp-releases remote instead, matching
terraform-vault and terraform-artifactapi.

- Replace dnf install vault with a pinned curl of the vault zip from the
  artifactapi hashicorp-releases remote, extracted to /usr/local/bin.
---
 .woodpecker/apply.yaml | 3 ++-
 .woodpecker/plan.yaml  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml
index 8c3e60f..1af462c 100644
--- a/.woodpecker/apply.yaml
+++ b/.woodpecker/apply.yaml
@@ -7,8 +7,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
       - make apply
     backend_options:
diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml
index 9f7952c..3f982dc 100644
--- a/.woodpecker/plan.yaml
+++ b/.woodpecker/plan.yaml
@@ -6,8 +6,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
     backend_options:
       kubernetes: