From 11260a81a4afb858add944a5050b360efba4e3cb Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 23 Aug 2026 22:38:04 +1000
Subject: [PATCH] ci: fetch vault from artifactapi instead of dnf install

dnf install reads metadata for every enabled repo and downloads the
vendored vault RPM on every pipeline run. Fetch the pinned upstream zip
from the artifactapi hashicorp-releases remote instead, matching
terraform-vault and terraform-artifactapi.

- Replace dnf install vault with a pinned curl of the vault zip from the
  artifactapi hashicorp-releases remote, extracted to /usr/local/bin.
---
 .woodpecker/apply.yaml | 3 ++-
 .woodpecker/plan.yaml  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml
index 8bfba46..ab1a9ca 100644
--- a/.woodpecker/apply.yaml
+++ b/.woodpecker/apply.yaml
@@ -7,8 +7,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
       - make apply
     backend_options:
diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml
index ad87ec9..2dbb407 100644
--- a/.woodpecker/plan.yaml
+++ b/.woodpecker/plan.yaml
@@ -6,8 +6,9 @@ steps:
     image: git.unkin.net/unkin/almalinux9-opentofu:20260606
     environment:
       VAULT_AUTH_METHOD: kubernetes
+      VAULT_VERSION: "1.20.0"
     commands:
-      - dnf install vault -y
+      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
       - make plan
     backend_options:
       kubernetes: