From bf0a604b9ca897f04f6b7fc2f89b7b65a2531a6f Mon Sep 17 00:00:00 2001
From: Ben Vincent <neotheo@gmail.com>
Date: Wed, 15 Jul 2026 22:22:31 +1000
Subject: [PATCH] Add vault-plugin-secrets-rancher +
 terraform-provider-ranchervaultsecret repos

Creates the two Gitea repositories backing the new Rancher token secrets engine:
a Vault/OpenBao plugin and its Terraform provider.

- Add config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml
  (squash-only, main protected on pre-commit/build/test).
- Add config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
  (same protection profile as the litellm provider repo).
---
 ...terraform-provider-ranchervaultsecret.yaml | 19 +++++++++++++++++++
 .../vault-plugin-secrets-rancher.yaml         | 19 +++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
 create mode 100644 config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml

diff --git a/config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml b/config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
new file mode 100644
index 0000000..fd87063
--- /dev/null
+++ b/config/git.unkin.net/unkin/repository/terraform-provider-ranchervaultsecret.yaml
@@ -0,0 +1,19 @@
+description: "Terraform provider for the Vault/OpenBao Rancher token secrets engine (ranchervaultsecret)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"
diff --git a/config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml
new file mode 100644
index 0000000..8d37163
--- /dev/null
+++ b/config/git.unkin.net/unkin/repository/vault-plugin-secrets-rancher.yaml
@@ -0,0 +1,19 @@
+description: "HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+# Squash-only: the gitea provider has no "default merge style", so we restrict
+# the allowed styles to squash to force it.
+allow_merge_commits: false
+allow_rebase: false
+allow_rebase_explicit: false
+allow_squash_merge: true
+branch_protection:
+  - rule_name: "main"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/pre-commit"
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+    approval_whitelist_teams:
+      - "Owners"