init: 아르고cd, vault 기반 인프라 설계

scripts/vault-transit/dev/ensure-unsealed.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:18200}"
+
+export VAULT_ADDR
+
+if ! command -v vault >/dev/null 2>&1; then
+  echo "vault CLI is required" >&2
+  exit 1
+fi
+
+status_json="$(mktemp)"
+trap 'rm -f "$status_json"' EXIT
+
+if vault status -format=json >"$status_json" 2>/dev/null; then
+  :
+else
+  if [[ ! -s "$status_json" ]]; then
+    echo "Vault transit provider is unreachable at ${VAULT_ADDR}" >&2
+    exit 1
+  fi
+fi
+
+initialized="$(jq -r '.initialized' "$status_json")"
+sealed="$(jq -r '.sealed' "$status_json")"
+
+if [[ "$initialized" != "true" ]]; then
+  echo "Transit provider Vault is not initialized." >&2
+  exit 1
+fi
+
+if [[ "$sealed" == "true" ]]; then
+  cat >&2 <<'EOF'
+Transit provider Vault is sealed.
+Manual unseal is required before the CI reconcile workflow can continue.
+Run the provider Vault runbook from runbooks/vault-transit/dev/README.md and unseal the vault-transit instance first.
+EOF
+  exit 1
+fi