Viktor Barzin 3eb8b9a4ea ci: add vault CLI to infra-ci image + surface real errors in scripts/tg ... The Woodpecker CI pipeline has been silently failing to apply Tier 1 stacks since the state-migration commit e80b2f02 because the Alpine CI image never had the vault CLI. `scripts/tg` swallowed stderr with `2>/dev/null` and surfaced a misleading "Cannot read PG credentials from Vault" message — the real error was `sh: vault: not found`. Verified with an in-cluster probe: woodpecker/default SA + role=ci already gets the terraform-state policy and has read capability on database/static-creds/pg-terraform-state. Auth was never the problem; the vault binary just wasn't there. - ci/Dockerfile: pin vault v1.18.1 (matches server) and install - scripts/tg: pre-flight check + surface real vault output on failure - Next build-ci-image.yml run rebuilds :latest with vault included; subsequent default.yml runs unblock monitoring apply (code-aoxk) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>		2026-04-22 08:46:50 +00:00
..
Dockerfile	ci: add vault CLI to infra-ci image + surface real errors in scripts/tg	2026-04-22 08:46:50 +00:00