Use shared .env.vault pattern

.woodpecker.yml

@@ -1,5 +1,5 @@
 steps:
-  - name: test-vault
+  - name: fetch-secrets
     image: hashicorp/vault:latest
     environment:
       VAULT_ADDR:
@@ -9,9 +9,16 @@ steps:
       VAULT_SECRET_ID:
         from_secret: vault_secret_id
     commands:
-      - echo "=== Authenticating with Vault via AppRole ==="
       - export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
-      - echo "Auth successful"
+      - vault kv get -format=json projects/test/demo | jq -r '.data.data | to_entries[] | "export \(.key)=\(.value)"' > .env.vault
-      - echo "=== Reading secrets from projects/test/demo ==="
+      - echo "Fetched secrets:"
-      - vault kv get projects/test/demo
+      - cat .env.vault
-      - echo "=== Vault integration works! ==="
+
+  - name: use-secrets
+    image: alpine
+    commands:
+      - source .env.vault
+      - echo "APP_NAME=$APP_NAME"
+      - echo "DB_HOST=$DB_HOST"
+      - echo "DB_PASS length=$(echo -n $DB_PASS | wc -c) chars"
+      - echo "Secrets are available in any step via .env.vault"