Scaffold vault-plugin-secrets-ghp secrets engine #1

2026-08-15T19:14:00+10:00

unkin-agent commented

2026-08-15 19:14:00 +10:00

Why

Machine callers of ghp (CI identities, agents) should never hold standing ghp
tokens. This engine mints ephemeral, scoped ghp access tokens on demand and
deletes them from ghp when the Vault lease is revoked or expires. It mirrors the
working vault-plugin-secrets-gitea engine, adjusted for ghp specifics: a static
service token instead of a rotated admin password, ghp's POST /api/tokens /
DELETE /api/tokens/{id} admin API, agent-token semantics, and ghp's
server-side token expiry as defence-in-depth on top of the lease.

Changes

Add config path: base_url (default https://ghp.unkin.net) + write-only
admin_token (ghpsvc_ service token) + TLS fields; verify the token is a ghp
admin (GET /api/users) on write. Deliberately no config/rotate-root — the
service token is static and operator-managed.
Add roles/<name> path: token_type (agent default / proxy),
installation_id, app_record_id, repositories, scopes
(permission:level), session_prefix, ttl, max_ttl.
Add creds/<role> path: mint a lease-bound token; set the ghp-side duration
to the lease ceiling so the token self-expires even if revocation never reaches
ghp.
Add ghp_token dynamic secret: idempotent revoke (404 = success) + lease renew.
Add client wrapper (bearer auth), scope normalisation/validation, and the
plugin cmd entrypoint.
Add unit tests (config, roles, creds lifecycle, client, scopes, idempotent
revocation, non-admin rejection) plus a mock-ghp e2e harness on Vault + OpenBao.
Add Woodpecker pre-commit/build/test (pull_request) and release (tag)
pipelines — every step sets k8s resources + serviceAccountName: default — a
Makefile with patch|minor|major tag targets, and nfpm RPM packaging.

Test

gofmt, go vet, go build ./..., and go test -race ./... all pass.

## Why Machine callers of ghp (CI identities, agents) should never hold standing ghp tokens. This engine mints ephemeral, scoped ghp access tokens on demand and deletes them from ghp when the Vault lease is revoked or expires. It mirrors the working `vault-plugin-secrets-gitea` engine, adjusted for ghp specifics: a static service token instead of a rotated admin password, ghp's `POST /api/tokens` / `DELETE /api/tokens/{id}` admin API, agent-token semantics, and ghp's server-side token expiry as defence-in-depth on top of the lease. ## Changes - Add `config` path: `base_url` (default `https://ghp.unkin.net`) + write-only `admin_token` (ghpsvc_ service token) + TLS fields; verify the token is a ghp admin (`GET /api/users`) on write. Deliberately no `config/rotate-root` — the service token is static and operator-managed. - Add `roles/<name>` path: `token_type` (agent default / proxy), `installation_id`, `app_record_id`, `repositories`, `scopes` (`permission:level`), `session_prefix`, `ttl`, `max_ttl`. - Add `creds/<role>` path: mint a lease-bound token; set the ghp-side `duration` to the lease ceiling so the token self-expires even if revocation never reaches ghp. - Add `ghp_token` dynamic secret: idempotent revoke (404 = success) + lease renew. - Add client wrapper (bearer auth), scope normalisation/validation, and the plugin `cmd` entrypoint. - Add unit tests (config, roles, creds lifecycle, client, scopes, idempotent revocation, non-admin rejection) plus a mock-ghp e2e harness on Vault + OpenBao. - Add Woodpecker `pre-commit`/`build`/`test` (pull_request) and `release` (tag) pipelines — every step sets k8s resources + `serviceAccountName: default` — a `Makefile` with `patch|minor|major` tag targets, and nfpm RPM packaging. ## Test `gofmt`, `go vet`, `go build ./...`, and `go test -race ./...` all pass.

unkin-agent added 1 commit 2026-08-15 19:14:00 +10:00

Scaffold ghp secrets engine modelled on vault-plugin-secrets-gitea

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

64d9b89dcd

Mints ephemeral, scoped ghp access tokens via ghp's admin token API
(POST /api/tokens), bound to a Vault lease and revoked on lease
expiry (DELETE /api/tokens/{id}).

- config: base_url + write-only admin_token (ghpsvc_ service token),
  TLS settings; verifies the token is a ghp admin on write. No
  rotate-root: the service token is static and operator-managed.
- roles: token_type (agent/proxy), installation_id, app_record_id,
  repositories, scopes (permission:level), session_prefix, ttl/max_ttl.
- creds: mint a lease-bound token; ghp-side duration bounded by the
  lease ceiling as defence in depth.
- secret ghp_token: idempotent revoke + lease renew.
- Unit tests (config/role/creds/client/scopes/revocation), mock-ghp
  e2e on Vault + OpenBao, Woodpecker pre-commit/build/test/release,
  Makefile patch/minor/major, nfpm RPM packaging.

benvin merged commit 995ad84c3e into main

2026-08-15 20:06:52 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-ghp#1