fix(ci): bastia-secret discovers Vault gateway at runtime for per-job containers #3

Merged

peterswimm merged 1 commit from fix/bastia-secret-dynamic-gateway-fallback into master

2026-09-03 17:40:40 +00:00

peterswimm commented

2026-09-03 17:38:58 +00:00

Owner

Scope

Updates .forgejo/actions/bastia-secret/action.yml's Vault-address probe chain to discover the Docker network gateway at runtime instead of relying on a hardcoded fallback IP. Adds a _discover_gateway() shell function (prefers ip route, falls back to parsing /proc/net/route) and wires its output into _vault_candidates in place of the static http://172.17.0.1:8200 entry.

Why

act_runner v12 does not honor container.options/--add-host for per-job container: jobs, so http://vault.forge:8200 never resolves inside those jobs. The previous fallback, a hardcoded http://172.17.0.1:8200, is also stale: each ephemeral per-job network gets its gateway dynamically allocated from a 10.128.0.0/9 pool, never that fixed address, so the fallback times out rather than reaching Vault. _discover_gateway() resolves the real gateway at runtime instead of trusting an address that inevitably drifts.

This is the same fix already applied to Toilville/forge-ci-workflows (PR #6), the canonical copy this repo vendors bastia-secret from. This repo doesn't currently call bastia-secret from any workflow — build-deploy.yml uses ssh-deploy-setup for its secret needs instead — so this change is purely preventative, applied for consistency in case bastia-secret gets wired up to a containerized job here later.

Testing

Validated YAML structure (python3 -c "import yaml; yaml.safe_load(...)") and bash syntax (bash -n) of the modified run: block. Validated the array-construction logic under set -u with both empty and populated _gateway_ip locally before propagating this identical patch from forge-ci-workflows. This repo doesn't currently exercise bastia-secret in any workflow, so there is nothing live here to re-verify against a running job.

Impact Statement

No behavior change for this repo today — no workflow here currently calls bastia-secret. This is a preventative consistency fix that keeps the vendored copy aligned with the canonical forge-ci-workflows action ahead of any future use. Touches only .forgejo/actions/bastia-secret/action.yml.

## Scope Updates `.forgejo/actions/bastia-secret/action.yml`'s Vault-address probe chain to discover the Docker network gateway at runtime instead of relying on a hardcoded fallback IP. Adds a `_discover_gateway()` shell function (prefers `ip route`, falls back to parsing `/proc/net/route`) and wires its output into `_vault_candidates` in place of the static `http://172.17.0.1:8200` entry. ## Why act_runner v12 does not honor `container.options`/`--add-host` for per-job `container:` jobs, so `http://vault.forge:8200` never resolves inside those jobs. The previous fallback, a hardcoded `http://172.17.0.1:8200`, is also stale: each ephemeral per-job network gets its gateway dynamically allocated from a `10.128.0.0/9` pool, never that fixed address, so the fallback times out rather than reaching Vault. `_discover_gateway()` resolves the real gateway at runtime instead of trusting an address that inevitably drifts. This is the same fix already applied to `Toilville/forge-ci-workflows` (PR #6), the canonical copy this repo vendors `bastia-secret` from. This repo doesn't currently call `bastia-secret` from any workflow — `build-deploy.yml` uses `ssh-deploy-setup` for its secret needs instead — so this change is purely preventative, applied for consistency in case `bastia-secret` gets wired up to a containerized job here later. ## Testing Validated YAML structure (`python3 -c "import yaml; yaml.safe_load(...)"`) and bash syntax (`bash -n`) of the modified `run:` block. Validated the array-construction logic under `set -u` with both empty and populated `_gateway_ip` locally before propagating this identical patch from forge-ci-workflows. This repo doesn't currently exercise `bastia-secret` in any workflow, so there is nothing live here to re-verify against a running job. ## Impact Statement No behavior change for this repo today — no workflow here currently calls `bastia-secret`. This is a preventative consistency fix that keeps the vendored copy aligned with the canonical `forge-ci-workflows` action ahead of any future use. Touches only `.forgejo/actions/bastia-secret/action.yml`.

peterswimm added 1 commit

2026-09-03 17:38:58 +00:00

fix(ci): bastia-secret discovers Vault gateway at runtime for per-job containers

PR policy check / policy-gate (pull_request) Successful in 0s

Details

c258fe0a42

act_runner v12 does not honor container.options/--add-host for per-job
container: jobs, so vault.forge never resolves there and the hardcoded
172.17.0.1 fallback is stale (each ephemeral per-job network gets a
dynamically allocated gateway from a 10.128.0.0/9 pool). Adds
_discover_gateway() (ip route, falling back to /proc/net/route parsing —
POSIX sh portable) and wires it into the _vault_candidates probe chain.

Same fix as Toilville/forge-ci-workflows PR #6 (the canonical copy this
repo vendors from). This repo doesn't currently call bastia-secret from
any workflow — applied for consistency in case it's wired up later.

peterswimm merged commit b8a693f7e5 into master

2026-09-03 17:40:40 +00:00

peterswimm deleted branch fix/bastia-secret-dynamic-gateway-fallback

2026-09-03 17:40:40 +00:00

peterswimm referenced this pull request from a commit

2026-09-03 17:40:41 +00:00

Merge pull request 'fix(ci): bastia-secret discovers Vault gateway at runtime for per-job containers' (#3) from fix/bastia-secret-dynamic-gateway-fallback into master