chore: remove vault_config schema definition and vault_store property from config schema

[BearTS]

Summary

Removes the vault_store configuration block and the vault_config schema definition from the transport config schema. This cleans up the external secret manager (vault) integration configuration that was previously defined for AWS Secrets Manager, GCP Secret Manager, and HashiCorp Vault backends.

Changes

• Removed the vault_store property from the transport configuration object
• Removed the vault_config $defs entry, which included all backend-specific sub-schemas for AWS, GCP, and HashiCorp Vault, along with their conditional required rules and field-level descriptions

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Validate that the config schema no longer accepts a vault_store key and that existing configurations without vault settings continue to validate correctly.

go test ./...

Breaking changes

• Yes
• No

Any transport configurations currently using the vault_store block will fail schema validation after this change. Users relying on vault-backed secret storage via this config block will need to migrate to an alternative secrets management approach before upgrading.

Related issues

Security considerations

This removes the schema support for delegating secret storage to external vault backends (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault). Ensure that any sensitive fields previously routed through vault are handled securely through an alternative mechanism after this change.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

Summary by CodeRabbit

• Configuration
  • Removed external secrets vault backend support from configuration, including AWS, GCP, and HashiCorp Vault integrations.
• Chores
  • Updated deployment configuration validation to replace the removed auth flag with explicit admin_username, admin_password, and is_enabled checks for both governance and top-level auth.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5d78941a-53c6-41d9-8fdb-b6214ca4faf2

📥 Commits

Reviewing files that changed from the base of the PR and between a8b690c and 1c8bccb.

📒 Files selected for processing (3)

• .github/workflows/scripts/validate-helm-config-fields.sh
• framework/configstore/config.go
• transports/config.schema.json

💤 Files with no reviewable changes (2)

• .github/workflows/scripts/validate-helm-config-fields.sh
• transports/config.schema.json

---

📝 Walkthrough

Walkthrough

Deletes the transport config vault backend: removes config_store.vault_store and $defs.vault_config from the schema, removes VaultStore handling from Config.UnmarshalJSON, and updates Helm validation to assert admin_username, admin_password, and is_enabled instead of disable_auth_on_inference.

Changes

Vault config removal and auth validation updates

Layer / File(s)	Summary
Remove VaultStore from Config unmarshalling framework/configstore/config.go	Removes VaultStore field from the public Config struct and deletes the assignment in UnmarshalJSON; retains enabled/type/config parsing and sqlite/postgres dispatch.
Remove vault_store and $defs.vault_config from schema transports/config.schema.json	Deletes the config_store.vault_store property and removes the entire $defs.vault_config definition (AWS/GCP/HashiCorp Vault conditional validation removed).
Update Helm auth validation assertions .github/workflows/scripts/validate-helm-config-fields.sh	Replaces disable_auth_on_inference checks with assertions for admin_username, admin_password, and is_enabled for both governance.auth_config and top-level auth_config.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• maximhq/bifrost#4245: Related removal of Vault backend enablement and vault resolution/cleanup logic across config-store code paths.

Suggested reviewers

• danpiths
• akshaydeo
• roroghost17

Poem

🐰 I hopped through schemas bright and bold,
Cleared vaults of secrets, stories told.
Configs now lighter, validations sing,
Admin fields trimmed like a spring.
Hooray — a tidy little code-fold!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: removing vault_config schema definition and vault_store property from the config schema.
Description check	✅ Passed	The description is comprehensive and follows the template structure with all major sections filled out, including summary, changes, type, affected areas, testing, breaking changes, and security considerations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-11-chore_remove_vault_store_reference

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BearTS]

• chore: remove vault_config schema definition and vault_store property from config schema #4295 👈 (View in Graphite)
• feat: add key_ids field to provider config in Helm chart and config schemas #4289
• feat: add unique constraint migration on customer table name field #4284
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the change removes schema and Go struct fields that were already agreed to be dormant, and cleans up unreachable test assertions.

All three files make consistent, targeted removals: the schema drops vault_store and vault_config, the Go struct drops the matching VaultStore field, and the test script removes assertions for a field the Helm template never emitted. No logic is altered, no other callers of the removed field exist in the OSS tree, and the developer has explicitly acknowledged keeping vault dormant.

No files require special attention.

Important Files Changed

Filename	Overview
transports/config.schema.json	Removes the vault_store property from config_store and the entire vault_config $defs entry; schema-level change is consistent with the Go struct cleanup in config.go
framework/configstore/config.go	Removes VaultStore json.RawMessage from Config and TempConfig structs and drops the assignment c.VaultStore = temp.VaultStore; aligns the Go struct with the schema removal
.github/workflows/scripts/validate-helm-config-fields.sh	Removes two assert_field_value calls for disable_auth_on_inference in both governance and top-level auth config sections; the Helm _helpers.tpl never rendered this deprecated field into the config JSON so these assertions were never valid

_{Reviews (2): Last reviewed commit: "chore: remove vault store reference" | Re-trigger Greptile}

[akshaydeo]

Merge activity

• Jun 11, 6:28 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 11, 6:31 PM UTC: @akshaydeo merged this pull request with Graphite.