apply vault config from CI

.gitea/workflows/vault.yaml

@@ -0,0 +1,48 @@
+---
+# template source: https://github.com/bretfisher/docker-build-workflow/blob/main/templates/call-docker-build.yaml
+name: Hashicorp Vault
+
+on: [push,pull_request]
+  # push: &helmPaths # turns out gitea don't handle well the paths filter
+  #   paths:
+  #     - '*/\.yaml'
+  #     - '*/\.tpl'
+  #     - '*/NOTES.txt'
+  #     - '*/\.helmignore'
+  # pull_request: *helmPaths
+
+# cancel any previously-started, yet still active runs of this workflow on the same branch
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  gitea_vault_auth:
+    name: Auth with gitea for vault
+    runs-on: ubuntu-latest
+    outputs:
+      gitea_vault_jwt: ${{steps.gitea_vault_jwt.outputs.access_token}}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Auth with gitea for vault
+        id: gitea_vault_jwt
+        run: |
+          VAULT_AUTH_JWT=`echo -n "${{ secrets.get_gitea_vault_jwt__sh_b64 }}" | base64 -d | sh \
+           | tee /dev/tty | tail -n 1 | awk '{print $NF}'`
+          echo "access_token=$VAULT_AUTH_JWT" >> $GITHUB_OUTPUT
+
+  tofu:
+    name: Library charts ${{ matrix.chart }}
+    needs:
+      - gitea_vault_auth
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/opentofu/opentofu:latest
+      env:
+        TERRAFORM_VAULT_AUTH_JWT: ${{ needs.gitea_vault_auth.outputs.access_token }}
+    steps:
+
+      - uses: actions/checkout@v4
+      - tofu -chdir=hashicorp-vault/iac init
+      - tofu -chdir=hashicorp-vault/iac apply -no-color -auto-approve