Replace URL-embedded token authentication with http.extraheader configuration for git operations. This approach is more secure as tokens don't appear in URLs or logs.
Change from:
git clone https://token:SECRET@host/repo.git
To:
git -c "http.extraheader=Authorization: token SECRET" clone https://host/repo.git
Also switch to direct.git.marketally.com for vault repository access.
Add VAULT_TOKEN environment variable to vault sync steps and use token-based authentication when cloning gitcaddy-vault repository. Falls back to unauthenticated clone if token is not provided.
This enables CI builds to access the private vault repository using the RELEASE_TOKEN secret.
- Fix sync-vault.sh to export SERVER_DIR and VAULT_PATH for Python heredoc
- Sync all vault translations including vault.type_file and vault.compare keys
- Add compare.tmpl template for version comparison feature
- Update vault templates from vault plugin
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add scripts/sync-vault.sh to sync templates and locales from vault
- Update build.yml to run sync after checkout on all platforms
- Vault repo is source of truth, server receives at build time
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
