---
id: w1/m10/t002
title: CI wiring — gh-secrets.sh gains BAO_* keys; deploy.yml runs bao-init + bao-k8s-auth each deploy
worker: worker1
status: done
estimate: 30m
depends_on: [w1/m10/t001]
---

## Objective

Make unseal survive redeploys with no hands: `scripts/gh-secrets.sh` pushes `BAO_UNSEAL_KEY_1..3` + `BAO_ROOT_TOKEN` into the repo's GitHub Actions secrets (alongside the existing `KRATOS_*`/`HYDRA_*`/`OPENFGA_*` keys), and `deploy.yml` runs `bao-init.sh` (idempotent — unseal only) + `bao-k8s-auth.sh` after the OpenBao rollout, the same shape as the existing `auth-secrets.sh`/`authz-model.sh` steps.

## Context

- docs/ADR013-secrets.md "Prod deploy path" steps 2–3; `scripts/gh-secrets.sh` key list currently lacks `BAO_*`.
- `.github/workflows/deploy.yml` already sequences auth bootstrap scripts — mirror that pattern.

## Steps

1. Extend `gh-secrets.sh`'s key list; run it once.
2. Add the deploy.yml steps (env from secrets, after the OpenBao Argo sync/rollout wait).
3. Trigger a deploy; verify the unseal step is a no-op-success on an already-unsealed store and recovers a sealed one (kill the pod first on a test run).

## Files

- `scripts/gh-secrets.sh`
- `.github/workflows/deploy.yml`

## Acceptance criteria

- [ ] A fresh deploy run unseals a sealed OpenBao and re-applies k8s-auth; a second run is idempotent.
- [ ] No secret value appears in workflow logs.

## Out of scope

- Auto-unseal via KMS (future); HA raft quorum (t003 sizes, doesn't cluster).
