From 290b9a9eb9f27b038cca26c595297aeff6c63643 Mon Sep 17 00:00:00 2001
From: Platform Engineer <platform@wectrl.net>
Date: Tue, 31 Mar 2026 19:59:09 +0300
Subject: [PATCH] harden: P1/P2 improvements from CON-571 review
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P1 — deploy-k8s.yaml:
- Add set -euo pipefail to all run blocks
- Replace sed-based image tag patching with yq for YAML-safe updates
- Add source commit SHA and CI run link to deploy commit messages
- Install yq v4.44.1 as prerequisite step

P1 — build-push.yaml:
- Add runner input parameter for future ARM64 self-hosted runners
  (default: ubuntu-latest with QEMU emulation)

P2 — test-python.yaml:
- Add pyproject.toml support (pip install -e) before requirements.txt fallback

P2 — build-push.yaml:
- Pin catthehacker/ubuntu container image to act-22.04 (was act-latest)

Ref: CON-578
---
 .gitea/workflows/build-push.yaml  |  9 +++++++--
 .gitea/workflows/deploy-k8s.yaml  | 16 ++++++++++++++--
 .gitea/workflows/test-python.yaml |  3 +++
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/build-push.yaml b/.gitea/workflows/build-push.yaml
index 3f8c0bc..625c90c 100644
--- a/.gitea/workflows/build-push.yaml
+++ b/.gitea/workflows/build-push.yaml
@@ -29,6 +29,11 @@ on:
         required: false
         type: string
         default: ""
+      runner:
+        description: "Runner label to use (e.g. ubuntu-latest, self-hosted-arm64). ARM64 builds use QEMU emulation on amd64 runners by default — set this to a native ARM64 runner for faster Rust/heavy builds."
+        required: false
+        type: string
+        default: "ubuntu-latest"
     secrets:
       REGISTRY_USER:
         required: true
@@ -42,9 +47,9 @@ on:
 jobs:
   build:
     name: Build & Push
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     container:
-      image: catthehacker/ubuntu:act-latest
+      image: catthehacker/ubuntu:act-22.04
       options: --privileged
     outputs:
       image-tag: ${{ steps.tag.outputs.tag }}
diff --git a/.gitea/workflows/deploy-k8s.yaml b/.gitea/workflows/deploy-k8s.yaml
index 502c1d2..57a62bc 100644
--- a/.gitea/workflows/deploy-k8s.yaml
+++ b/.gitea/workflows/deploy-k8s.yaml
@@ -34,11 +34,20 @@ jobs:
     runs-on: ubuntu-latest
     if: gitea.ref == 'refs/heads/main'
     steps:
+      - name: Install yq
+        run: |
+          set -euo pipefail
+          wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_amd64
+          chmod +x /usr/local/bin/yq
+
       - name: Update image tag in cluster repo
         run: |
+          set -euo pipefail
+
           SHA="${{ gitea.sha }}"
           SHORT_SHA="${SHA:0:7}"
           IMAGE_TAG="sha-${SHORT_SHA}"
+          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
 
           git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
           cd wectrl-k8s-cluster
@@ -47,7 +56,7 @@ jobs:
           git config user.name "Gitea CI"
 
           for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
-            sed -i "s|image: ${{ inputs.image-name }}:.*|image: ${{ inputs.image-name }}:${IMAGE_TAG}|g" \
+            yq -i '(.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))) = "${{ inputs.image-name }}:'"${IMAGE_TAG}"'"' \
               "${DEPLOY_PATH}"
             git add "${DEPLOY_PATH}"
           done
@@ -55,7 +64,10 @@ jobs:
           if git diff --staged --quiet; then
             echo "No image tag changes to commit"
           else
-            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}"
+            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}
+
+Source: ${SHA}
+Run: ${RUN_URL}"
             git push origin main
             echo "Cluster repo updated — ArgoCD will sync within ~3 min"
           fi
diff --git a/.gitea/workflows/test-python.yaml b/.gitea/workflows/test-python.yaml
index 7dab52e..caab1d1 100644
--- a/.gitea/workflows/test-python.yaml
+++ b/.gitea/workflows/test-python.yaml
@@ -39,6 +39,9 @@ jobs:
         run: |
           if [ -n "${{ inputs.install-command }}" ]; then
             ${{ inputs.install-command }}
+          elif [ -f "${{ inputs.working-directory }}/pyproject.toml" ]; then
+            pip install -e "${{ inputs.working-directory }}"
+            pip install pytest pytest-asyncio
           elif [ -f "${{ inputs.working-directory }}/requirements.txt" ]; then
             pip install -r ${{ inputs.working-directory }}/requirements.txt
             pip install pytest pytest-asyncio