feat: Add composite action to install host-side CLI tools (vault, bats) and update CI workflow

Signed-off-by: Alex Lovell-Troy <alex@lovelltroy.org>

Author: alexlovelltroy

.github/actions/setup-tools/action.yml

@@ -0,0 +1,41 @@
+# Composite action that installs the host-side CLI tools the sandbox
+# fixtures and bats suite expect on a runner. Currently:
+#
+#   vault — fixtures/vault-seed.sh and tests/bats/cli-smoke.bats both
+#           shell out to the vault CLI; not preinstalled on ubuntu-latest.
+#   bats  — tests/bats/*.bats are bash-test scripts; not preinstalled.
+#
+# Idempotent: each step checks for the binary and short-circuits if
+# present, so calling this from setup + test-bats + test-uc* is cheap on
+# a hot apt cache and re-runs cleanly under `act`.
+name: setup-tools
+description: Install host-side CLI tools (vault, bats) the sandbox needs.
+
+runs:
+  using: composite
+  steps:
+    - name: Install bats
+      shell: bash
+      run: |
+        if command -v bats >/dev/null 2>&1; then
+          echo "bats already installed: $(bats --version)"
+          exit 0
+        fi
+        sudo apt-get update -qq
+        sudo apt-get install -y --no-install-recommends bats
+        bats --version
+
+    - name: Install vault CLI
+      shell: bash
+      run: |
+        if command -v vault >/dev/null 2>&1; then
+          echo "vault already installed: $(vault --version)"
+          exit 0
+        fi
+        curl -fsSL https://apt.releases.hashicorp.com/gpg \
+          | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
+        echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" \
+          | sudo tee /etc/apt/sources.list.d/hashicorp.list >/dev/null
+        sudo apt-get update -qq
+        sudo apt-get install -y --no-install-recommends vault
+        vault --version

.github/workflows/ci.yml

@@ -125,8 +125,8 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
-      - name: Install bats
-        run: sudo apt-get update && sudo apt-get install -y bats
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -184,8 +184,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install bats
-        run: sudo apt-get update && sudo apt-get install -y bats
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -252,6 +252,9 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         continue-on-error: true
@@ -341,6 +344,9 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         continue-on-error: true
@@ -430,6 +436,9 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         continue-on-error: true
@@ -519,6 +528,9 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         continue-on-error: true
@@ -608,6 +620,9 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         continue-on-error: true
@@ -697,6 +712,9 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         continue-on-error: true
@@ -786,6 +804,9 @@ jobs:
           cache: true
           cache-dependency-path: tests/go.sum
 
+      - name: Install host-side tools (vault, bats)
+        uses: ./.github/actions/setup-tools
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         continue-on-error: true