From 757b07c22f79ceadde748270814962bc78ef658f Mon Sep 17 00:00:00 2001
From: klaatu <klaatu@thehellings.com>
Date: Sat, 4 Apr 2026 19:05:17 +0000
Subject: [PATCH] fix: replace placeholder Secret with ExternalSecret via
 bitwarden-login

---
 manifests/gitea-runner/secrets.yaml | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/manifests/gitea-runner/secrets.yaml b/manifests/gitea-runner/secrets.yaml
index 60c00ed..4fb1503 100644
--- a/manifests/gitea-runner/secrets.yaml
+++ b/manifests/gitea-runner/secrets.yaml
@@ -1,16 +1,18 @@
-# FIXME: This Secret is a placeholder only!
-# Greg must generate a runner registration token from the Gitea web UI
-# (Site Administration → Actions → Runners → Create Runner Token),
-# then store it in agenix and wire it up to populate this Secret.
-# The Secret should have key: token
-#
-# Until this Secret exists in the cluster, the gitea-runner HelmRelease
-# will fail to deploy.
-apiVersion: v1
-kind: Secret
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
 metadata:
   name: gitea-runner
   namespace: gitea-runner
-stringData:
-  # FIXME: Replace with actual runner token (managed via agenix / external-secrets)
-  token: "REPLACE_ME_WITH_ACTUAL_TOKEN"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  target:
+    name: gitea-runner
+    creationPolicy: Owner
+  data:
+    - secretKey: token
+      remoteRef:
+        key: 11419680-5338-4f19-bdd9-b422007046af
+        property: password