From c1acb29c8c1f9d9451775634a3744c36da0a27b1 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 25 Oct 2026 20:34:19 +1100
Subject: [PATCH] ci: authenticate artifactapi provider upload with a vault
 token

---
 .woodpecker/release.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.woodpecker/release.yml b/.woodpecker/release.yml
index 2e039d8..399c348 100644
--- a/.woodpecker/release.yml
+++ b/.woodpecker/release.yml
@@ -35,9 +35,16 @@ steps:
       - |
         VERSION=$$(echo ${CI_COMMIT_TAG} | sed 's/^v//')
         FILE="terraform-provider-binarylane_$${VERSION}_linux_amd64.zip"
+        set -o pipefail
+        VAULT="https://vault.service.consul:8200"
+        AUTH=$$(mktemp)
+        VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \
+          | curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1
+        printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
+          | jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1
         curl -f -X PUT \
           "https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/terraform-unkin/files/unkin/binarylane/$${FILE}" \
-          -H "Content-Type: application/zip" \
+          -H "Content-Type: application/zip" -H @"$$AUTH" \
           --data-binary @"$${FILE}"
     depends_on: [package]
     backend_options: