From fafba02948ee37ee7c61492d05cc8cffe54019ad Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 15 Aug 2026 18:24:40 +1000
Subject: [PATCH] add ghp Vault engine repos (plugin + terraform provider)

P4 steps 5-6: a Vault/OpenBao secrets engine that mints scoped ghp access tokens
via ghp's admin API (authenticating with the static admin service token now
deployed), plus its Terraform provider. Mirrors the vault-plugin-secrets-gitea /
terraform-provider-giteavaultsecret pair.
---
 .../terraform-provider-ghpvaultsecret.yaml    | 21 +++++++++++++++++++
 .../repository/vault-plugin-secrets-ghp.yaml  | 21 +++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 config/git.unkin.net/unkin/repository/terraform-provider-ghpvaultsecret.yaml
 create mode 100644 config/git.unkin.net/unkin/repository/vault-plugin-secrets-ghp.yaml

diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-ghpvaultsecret.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-ghpvaultsecret.yaml
new file mode 100644
index 0000000..55411db
--- /dev/null
+++ b/config/git.unkin.net/unkin/repository/terraform-provider-ghpvaultsecret.yaml
@@ -0,0 +1,21 @@
+description: "Terraform provider for the Vault/OpenBao ghp token secrets engine (ghpvaultsecret)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-ghp.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-ghp.yaml
new file mode 100644
index 0000000..43342f5
--- /dev/null
+++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-ghp.yaml
@@ -0,0 +1,21 @@
+description: "HashiCorp Vault / OpenBao secrets engine for ghp: mints ephemeral, scoped access tokens via the ghp admin API, authenticating as a static admin service token"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"