---
# gitea-runner-secret — Gitea act-runner registration token
# GITEA_INSTANCE_URL is static (not a secret); GITEA_RUNNER_REGISTRATION_TOKEN comes from Vault
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gitea-runner-secret
  namespace: ci
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: gitea-runner-secret
    creationPolicy: Owner
    template:
      data:
        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
        GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
  data:
    - secretKey: runner_token
      remoteRef:
        key: secret/data/gitea
        property: runner_token