From 1210e123676f312d002e12033994eee19c10db9e Mon Sep 17 00:00:00 2001
From: Bharat Kathi <bharat1031@gmail.com>
Date: Fri, 10 Jul 2026 22:15:05 -0700
Subject: [PATCH] chore(deploy): fetch INFRA_PR_TOKEN from Vault via
 vault-pull-secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Match the pattern in the Gaucho-Racing/Vault deploy workflow: use
Gaucho-Racing/vault-pull-secrets@v1 with GitHub OIDC to fetch the infra
PR token at runtime from the `infrastructure.pr_token` app-secret in
Vault, instead of storing it as a long-lived repo secret.

Advantages:
- One less place a token has to live (single source of truth in Vault)
- Rotate the token via Vault UI without touching every consuming repo
- Ephemeral: token only exists in the workflow's runtime process, not
  in GitHub's secret store

The workflow's `id-token: write` permission is what lets vault-pull-secrets
exchange the GitHub OIDC token for a Vault-issued auth. The Vault-side
kubernetes/OIDC rule that already permits this pattern from the vault
repo's deploy workflow needs to also permit the sentinel repo — if not
already covered by a wildcard rule, the sentinel workflow will fail on
the vault fetch step until a rule is added.
---
 .github/workflows/deploy.yml | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7aa4913..76cae64 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -5,9 +5,12 @@ run-name: Open infrastructure PR for ${{ github.event.release.tag_name }}
 # bumps the sentinel service image tags to the new version. Fires on the
 # release event (not tag push) so it only ever runs for real releases.
 #
-# Requires repo secret INFRA_PR_TOKEN: a PAT (or GitHub App token) with
-# contents:write + pull-requests:write on Gaucho-Racing/infrastructure. The
-# default GITHUB_TOKEN can't write to another repo.
+# The infra PR token is stored in Vault (app-secret `infrastructure`,
+# field `pr_token`) and fetched at runtime by vault-pull-secrets using
+# the workflow's GitHub OIDC identity — no long-lived repo secret. The
+# token is a PAT with contents:write + pull-requests:write on
+# Gaucho-Racing/infrastructure. The default GITHUB_TOKEN can't write to
+# another repo.
 on:
   release:
     types: [published]
@@ -22,6 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write        # for Vault OIDC auth via vault-pull-secrets
     steps:
       - name: Checkout sentinel (full history + tags)
         uses: actions/checkout@v4
@@ -29,11 +33,17 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Pull secrets
+        id: vault
+        uses: Gaucho-Racing/vault-pull-secrets@v1
+        with:
+          secrets: infrastructure.pr_token
+
       - name: Checkout infrastructure
         uses: actions/checkout@v4
         with:
           repository: ${{ env.INFRA_REPO }}
-          token: ${{ secrets.INFRA_PR_TOKEN }}
+          token: ${{ fromJSON(steps.vault.outputs.secrets_json).PR_TOKEN }}
           path: infra
 
       - name: Resolve versions
@@ -122,7 +132,7 @@ jobs:
         if: steps.versions.outputs.skip == 'false'
         working-directory: infra
         env:
-          GH_TOKEN: ${{ secrets.INFRA_PR_TOKEN }}
+          GH_TOKEN: ${{ fromJSON(steps.vault.outputs.secrets_json).PR_TOKEN }}
           NEW: ${{ steps.versions.outputs.new }}
           NEW_TAG: ${{ steps.versions.outputs.new_tag }}
           SHORT_SHA: ${{ steps.versions.outputs.short_sha }}