From b72fb609f76ebc47dbd1200d2154c7cefa0cb4b2 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 23 Aug 2026 22:37:47 +1000
Subject: [PATCH] ci: fetch vault from artifactapi instead of dnf install

dnf install reads metadata for every enabled repo and downloads the
vendored vault RPM on every pipeline run. Fetch the pinned upstream zip
from the artifactapi hashicorp-releases remote instead, matching
terraform-vault and terraform-artifactapi.

- Replace dnf install vault with a pinned curl of the vault zip from the
  artifactapi hashicorp-releases remote, extracted to /usr/local/bin.
---
 .woodpecker/apply.yaml | 3 ++-
 .woodpecker/plan.yaml  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml
index 9c27ca9..ca914ab 100644
--- a/.woodpecker/apply.yaml
+++ b/.woodpecker/apply.yaml
@@ -7,8 +7,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
       - make apply
     backend_options:
diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml
index 56dd8db..928eeba 100644
--- a/.woodpecker/plan.yaml
+++ b/.woodpecker/plan.yaml
@@ -6,8 +6,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
     backend_options:
       kubernetes: