Cut forgejo package prune over to OpenBao lane

tests/test_forgejo_package_prune.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import importlib.util
 import sys
+import tempfile
 import unittest
 from pathlib import Path
 from unittest import mock
@@ -63,7 +64,6 @@ image:
         self.assertEqual(deletable, {("vergabe-teilnahme", "v1")})
         self.assertEqual(protected_plans, {("vergabe-teilnahme", "old-prod")})
 
-
     def test_collect_live_cluster_versions_protects_forgejo_tags(self) -> None:
         images = "\n".join([
             "forgejo.coulomb.social/coulomb/state-hub:f2e042a",
@@ -93,6 +93,70 @@ image:
         self.assertEqual(protected, set())
         self.assertTrue(notes and "kubectl not found" in notes[0])
 
+    def test_load_token_prefers_explicit_env(self) -> None:
+        with mock.patch.dict(prune.os.environ, {"FORGEJO_TOKEN": " env-token "}, clear=True):
+            with mock.patch.object(prune, "_load_token_from_openbao") as load_openbao:
+                self.assertEqual(prune.load_token(), "env-token")
+        load_openbao.assert_not_called()
+
+    def test_load_token_reads_explicit_token_file_env(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            token_file = Path(tmpdir) / "forgejo-admin.token"
+            token_file.write_text(" file-token \n", encoding="utf-8")
+            with mock.patch.dict(
+                prune.os.environ,
+                {"FORGEJO_TOKEN_FILE": str(token_file)},
+                clear=True,
+            ):
+                with mock.patch.object(prune, "_load_token_from_openbao") as load_openbao:
+                    self.assertEqual(prune.load_token(), "file-token")
+            load_openbao.assert_not_called()
+
+    def test_load_token_uses_openbao_lane_by_default(self) -> None:
+        with mock.patch.dict(prune.os.environ, {}, clear=True):
+            with mock.patch.object(prune.shutil, "which", return_value="/usr/bin/bao"), \
+                 mock.patch.object(
+                     prune.subprocess,
+                     "run",
+                     return_value=mock.Mock(stdout=" bao-token \n"),
+                 ) as run_mock:
+                self.assertEqual(prune.load_token(), "bao-token")
+        run_mock.assert_called_once_with(
+            [
+                "bao",
+                "kv",
+                "get",
+                f"-field={prune.DEFAULT_FORGEJO_ADMIN_BAO_FIELD}",
+                prune.DEFAULT_FORGEJO_ADMIN_BAO_PATH,
+            ],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+
+    def test_load_token_uses_legacy_file_only_when_opted_in(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            legacy_file = Path(tmpdir) / "forgejo-tegwick-api-token"
+            legacy_file.write_text("legacy-token\n", encoding="utf-8")
+            with mock.patch.dict(
+                prune.os.environ,
+                {"FORGEJO_ALLOW_LEGACY_FILE_FALLBACK": "1"},
+                clear=True,
+            ):
+                with mock.patch.object(prune.shutil, "which", return_value=None), \
+                     mock.patch.object(prune, "LEGACY_FORGEJO_TOKEN_FILE", legacy_file):
+                    self.assertEqual(prune.load_token(), "legacy-token")
+
+    def test_load_token_error_mentions_openbao_and_break_glass(self) -> None:
+        with mock.patch.dict(prune.os.environ, {}, clear=True):
+            with mock.patch.object(prune.shutil, "which", return_value=None):
+                with self.assertRaises(SystemExit) as exc_info:
+                    prune.load_token()
+        message = str(exc_info.exception)
+        self.assertIn("forgejo-admin-workload-kv-read", message)
+        self.assertIn("FORGEJO_ALLOW_LEGACY_FILE_FALLBACK=1", message)
+        self.assertIn(prune.DEFAULT_FORGEJO_ADMIN_BAO_PATH, message)
+
 
 if __name__ == "__main__":
     unittest.main()