---
# gitea-runner-secret — neural-platform org runner token
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gitea-runner-secret
  namespace: ci
  annotations:
    force-sync: "2026-04-23"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: gitea-runner-secret
    creationPolicy: Owner
    template:
      data:
        # Public URL — the in-cluster name (gitea.git.svc.cluster.local) is
        # not resolvable from build containers running with `network: host`,
        # which causes `git fetch` to fail at the very first checkout step.
        # The runner polls Gitea over Cloudflare; the latency cost is small
        # and the build container's clone URL is derived from this instance,
        # so it has to be a name the build container can resolve.
        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: runner_token
---
# neuron-technologies-runner-secret — neuron-technologies org runner token
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: neuron-technologies-runner-secret
  namespace: ci
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: neuron-technologies-runner-secret
    creationPolicy: Owner
    template:
      data:
        # Public URL — see commentary on the gitea-runner-secret above.
        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: neuron_technologies_runner_token