---
# gitea-runner-secret — neural-platform org runner token
#
# GITEA_INSTANCE_URL: act_runner daemon polls git.neuralplatform.ai via HTTPS.
# GITEA_SSH_PRIVATE_KEY: ED25519 deploy key for SSH-based git clones inside
#   build containers. git-ssh-init.sh (sourced via BASH_ENV) writes this key
#   to ~/.ssh/gitea_key and rewrites HTTPS Gitea URLs to SSH so that
#   actions/checkout and plain `git clone` both use SSH auth without any
#   HTTPS credential or CF Access token.
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gitea-runner-secret
  namespace: ci
  annotations:
    force-sync: "2026-05-05-gitea-proxy"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: gitea-runner-secret
    creationPolicy: Owner
    template:
      data:
        GITEA_INSTANCE_URL: "http://gitea-proxy.ci.svc.cluster.local:3000"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
        GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: runner_token
    - secretKey: ci_ssh_private_key
      remoteRef:
        key: secret/data/gitea
        property: ci_ssh_private_key
---
# neuron-technologies-runner-secret — neuron-technologies org runner token
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: neuron-technologies-runner-secret
  namespace: ci
  annotations:
    force-sync: "2026-05-05-gitea-proxy"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: neuron-technologies-runner-secret
    creationPolicy: Owner
    template:
      data:
        GITEA_INSTANCE_URL: "http://gitea-proxy.ci.svc.cluster.local:3000"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
        GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: neuron_technologies_runner_token
    - secretKey: ci_ssh_private_key
      remoteRef:
        key: secret/data/gitea
        property: ci_ssh_private_key