Exercise 3: Running an Encrypted-Variable Playbook From CI, With No Human — Possible Solution
====================================================================

-- Which vault option is appropriate --
--
-- --vault-password-file is exactly the option the chapter names as
-- "the practical option for CI, where nothing can be typed
-- interactively" -- unlike --ask-vault-pass, which requires a human
-- to be present to respond to an interactive prompt, this flag points
-- Ansible at a file (or an executable script that OUTPUTS the
-- password) it can read automatically at run time with no human
-- involved at all, exactly what an unattended CI pipeline needs.

-- Where the password itself should actually be stored --
--
-- The chapter's own tip-box is explicit that the vault password
-- should never be stored anywhere near the repo it protects, and
-- specifically names "a protected pipeline secret injected at run
-- time" as the correct approach for CI specifically -- directly
-- reusing pipelines1-5's own established CI-secrets pattern rather
-- than inventing a new one for this course. Concretely, this means
-- the vault password should be stored in the CI system's own secrets
-- store (e.g. a GitHub Actions secret, or an equivalent mechanism in
-- whatever CI platform is in use), injected into the pipeline's
-- environment only at run time, and then written to a temporary file
-- (or referenced via a small script) that --vault-password-file
-- points at -- never committed to the repository itself, and never
-- hardcoded directly into the pipeline configuration file in plain
-- text.

WHY THIS WORKS AS AN ANSWER
------------------------------
This identifies the correct non-interactive vault option by name and
explains why it fits the no-human-available constraint, then answers
the "where should the password live" half of the question by directly
connecting the chapter's own tip-box to pipelines1-5's own
already-established CI-secrets pattern rather than treating it as an
unrelated new question.