feat: lib/vault.sh — helper for agents to create vault PRs on ops repo #75

New issue

Closed

opened 2026-03-31 19:53:47 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-03-31 19:53:47 +00:00

Collaborator

Context

Any agent can request a vault action by creating a PR on the ops repo. This issue adds a shared library function that agents call to do that.

What to do

Create lib/vault.sh with a function like:

vault_request(action_id, toml_content)

The function should:

Validate the TOML content using the validator from #74
Create a branch on the ops repo: vault/<action-id>
Write the TOML file to vault/actions/<action-id>.toml on that branch
Create a PR targeting main with title vault: <action-id> and body extracted from the TOML context field
Return the PR number so the calling agent can track it

Use the Forgejo API (not git push) so it works from inside containers without SSH.

Considerations

The PR should be created using the calling agents own FORGE_TOKEN (not a shared token)
The function should be idempotent — if a PR for the same action-id already exists, return its number instead of creating a duplicate
Add to lib/AGENTS.md documentation

Verification

Source lib/vault.sh and call vault_request with a test TOML — PR appears on ops repo
Calling again with same action-id returns existing PR number
Invalid TOML is rejected before PR creation

Dependencies

Depends on #74 (TOML schema + validator).

## Context Any agent can request a vault action by creating a PR on the ops repo. This issue adds a shared library function that agents call to do that. ## What to do Create `lib/vault.sh` with a function like: ```bash vault_request(action_id, toml_content) ``` The function should: 1. Validate the TOML content using the validator from #74 2. Create a branch on the ops repo: `vault/<action-id>` 3. Write the TOML file to `vault/actions/<action-id>.toml` on that branch 4. Create a PR targeting `main` with title `vault: <action-id>` and body extracted from the TOML context field 5. Return the PR number so the calling agent can track it Use the Forgejo API (not git push) so it works from inside containers without SSH. ## Considerations - The PR should be created using the calling agents own FORGE_TOKEN (not a shared token) - The function should be idempotent — if a PR for the same action-id already exists, return its number instead of creating a duplicate - Add to `lib/AGENTS.md` documentation ## Verification - Source `lib/vault.sh` and call `vault_request` with a test TOML — PR appears on ops repo - Calling again with same action-id returns existing PR number - Invalid TOML is rejected before PR creation ## Dependencies Depends on #74 (TOML schema + validator).