feat: add environment-based image tags (prod/staging/dev) to CI templates

build-push.yaml now pushes branch-conditional env tags alongside SHA tags:
- main/master → prod, staging → staging, dev → dev
- Optional version input for pinned dev-v{N} tags
- New env-tag output for downstream consumers

deploy-k8s.yaml adds use-env-tag option:
- When true, skips SHA-based manifest updates and instead bumps a deploy
  annotation so ArgoCD rolls pods with the mutable tag
- Backward compatible: existing services using SHA tags are unaffected

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy-k8s.yaml

@@ -22,6 +22,11 @@ on:
         required: false
         type: string
         default: "wectrl-net/wectrl-k8s-cluster"
+      use-env-tag:
+        description: "If true, skip SHA-based manifest update (service uses mutable env tags with imagePullPolicy: Always)"
+        required: false
+        type: boolean
+        default: false
     secrets:
       GIT_USER:
         required: true
@@ -32,7 +37,7 @@ jobs:
   deploy:
     name: Update k8s Cluster Repo
     runs-on: ubuntu-latest
-    if: gitea.ref == 'refs/heads/main'
+    if: gitea.ref == 'refs/heads/main' && inputs.use-env-tag == false
     steps:
       - name: Install yq
         shell: bash
@@ -76,3 +81,61 @@ jobs:
             git push origin main
             echo "Cluster repo updated — ArgoCD will sync within ~3 min"
           fi
+
+  # When using mutable env tags, bump a deploy annotation so ArgoCD detects the change
+  notify-argocd:
+    name: Bump deploy annotation
+    runs-on: ubuntu-latest
+    if: inputs.use-env-tag == true
+    steps:
+      - name: Install yq
+        shell: bash
+        run: |
+          set -euo pipefail
+          ARCH=$(uname -m)
+          case "$ARCH" in
+            aarch64|arm64) YQ_ARCH="arm64" ;;
+            x86_64|amd64)  YQ_ARCH="amd64" ;;
+            *)             YQ_ARCH="amd64" ;;
+          esac
+          wget -qO /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_${YQ_ARCH}"
+          chmod +x /usr/local/bin/yq
+
+      - name: Bump annotation in cluster repo
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          SHA="${{ gitea.sha }}"
+          SHORT_SHA="${SHA:0:7}"
+          TIMESTAMP="$(date -u +%Y%m%d%H%M%S)"
+          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
+
+          # Determine env from branch
+          REF="${{ gitea.ref }}"
+          case "$REF" in
+            refs/heads/main|refs/heads/master) ENV_TAG="prod" ;;
+            refs/heads/staging) ENV_TAG="staging" ;;
+            refs/heads/dev) ENV_TAG="dev" ;;
+            *) echo "Branch not mapped to environment, skipping"; exit 0 ;;
+          esac
+
+          git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
+          cd wectrl-k8s-cluster
+
+          git config user.email "ci@wectrl.net"
+          git config user.name "Gitea CI"
+
+          for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
+            yq -i '.spec.template.metadata.annotations."deploy.wectrl.net/restart" = "'"${TIMESTAMP}-sha-${SHORT_SHA}"'"' \
+              "${DEPLOY_PATH}"
+            git add "${DEPLOY_PATH}"
+          done
+
+          if git diff --staged --quiet; then
+            echo "No annotation changes to commit"
+          else
+            git commit -m "deploy: ${{ inputs.service-name }} ${ENV_TAG} (sha-${SHORT_SHA})"
+            git push origin main
+            echo "Annotation bumped — ArgoCD will roll pods within ~3 min"
+          fi