From bded32ea96cf1b21f54199cde146ffbfd0955b7a Mon Sep 17 00:00:00 2001
From: Jurie Smit <smit.jurie@gmail.com>
Date: Fri, 17 Jul 2026 21:42:52 +0200
Subject: [PATCH] Bootstrap dev Key Vault access before apply

---
 .github/workflows/infrastructure.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/infrastructure.yml b/.github/workflows/infrastructure.yml
index 0785d9d..e13216e 100644
--- a/.github/workflows/infrastructure.yml
+++ b/.github/workflows/infrastructure.yml
@@ -212,6 +212,23 @@ jobs:
           tenant-id: ${{ steps.azure-creds.outputs.tenant-id }}
           subscription-id: ${{ steps.azure-creds.outputs.subscription-id }}
 
+      - name: Bootstrap Dev Key Vault Access
+        if: matrix.environment == 'dev'
+        run: |
+          set -euo pipefail
+          DEPLOYER_OBJECT_ID=$(az ad sp show \
+            --id "${{ steps.azure-creds.outputs.client-id }}" \
+            --query id \
+            -o tsv)
+          if [ -z "$DEPLOYER_OBJECT_ID" ]; then
+            echo "Error: failed to resolve Azure service principal object ID" >&2
+            exit 1
+          fi
+          az keyvault set-policy \
+            --name nl-dev-convolens-kv \
+            --object-id "$DEPLOYER_OBJECT_ID" \
+            --secret-permissions get list set delete purge recover
+
       - name: Terraform Init
         env:
           ARM_CLIENT_ID: ${{ steps.azure-creds.outputs.client-id }}