fix(deploy): fix silent success on failed deploys (CON-654)

- Fix boolean type coercion: use !inputs.use-env-tag instead of == false
- Fail loudly (exit 1) when deploy produces no changes instead of exit 0
- Add debug logging: image name, tag, deploy paths, current/updated images
- Validate yq actually matched and updated container images before committing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy-k8s.yaml

@@ -37,7 +37,7 @@ jobs:
   deploy:
     name: Update k8s Cluster Repo
     runs-on: ubuntu-latest
-    if: gitea.ref == 'refs/heads/main' && inputs.use-env-tag == false
+    if: gitea.ref == 'refs/heads/main' && !inputs.use-env-tag
     steps:
       - name: Install yq
         shell: bash
@@ -62,31 +62,64 @@ jobs:
           IMAGE_TAG="sha-${SHORT_SHA}"
           RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
 
+          echo "=== Deploy parameters ==="
+          echo "Image: ${{ inputs.image-name }}"
+          echo "Tag: ${IMAGE_TAG}"
+          echo "Deploy paths: ${{ inputs.deploy-paths }}"
+          echo "K8s repo: ${{ inputs.k8s-repo }}"
+          echo "========================="
+
           git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
           cd wectrl-k8s-cluster
 
           git config user.email "ci@wectrl.net"
           git config user.name "Gitea CI"
 
+          MATCHED=0
           for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
+            echo "Processing: ${DEPLOY_PATH}"
+
+            # Show current image before update
+            CURRENT_IMAGE=$(yq '.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))' "${DEPLOY_PATH}" 2>/dev/null || true)
+            if [ -z "${CURRENT_IMAGE}" ]; then
+              echo "ERROR: No container image matching '${{ inputs.image-name }}:*' found in ${DEPLOY_PATH}"
+              echo "Images in file:"
+              yq '.spec.template.spec.containers[].image' "${DEPLOY_PATH}" || true
+              exit 1
+            fi
+            echo "  Current: ${CURRENT_IMAGE}"
+
             yq -i '(.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))) = "${{ inputs.image-name }}:'"${IMAGE_TAG}"'"' \
               "${DEPLOY_PATH}"
+
+            # Verify the update took effect
+            UPDATED_IMAGE=$(yq '.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))' "${DEPLOY_PATH}")
+            echo "  Updated: ${UPDATED_IMAGE}"
+            if [ "${UPDATED_IMAGE}" != "${{ inputs.image-name }}:${IMAGE_TAG}" ]; then
+              echo "ERROR: Image tag update failed for ${DEPLOY_PATH}"
+              exit 1
+            fi
+
+            MATCHED=$((MATCHED + 1))
             git add "${DEPLOY_PATH}"
           done
 
+          echo "Successfully updated ${MATCHED} manifest(s)"
+
           if git diff --staged --quiet; then
-            echo "No image tag changes to commit"
-          else
+            echo "ERROR: No image tag changes to commit — manifests may already be at ${IMAGE_TAG}"
+            exit 1
+          fi
+
           git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}"
           git push origin main
           echo "Cluster repo updated — ArgoCD will sync within ~3 min"
-          fi
 
   # When using mutable env tags, bump a deploy annotation so ArgoCD detects the change
   notify-argocd:
     name: Bump deploy annotation
     runs-on: ubuntu-latest
-    if: inputs.use-env-tag == true
+    if: inputs.use-env-tag
     steps:
       - name: Install yq
         shell: bash
@@ -120,6 +153,13 @@ jobs:
             *) echo "Branch not mapped to environment, skipping"; exit 0 ;;
           esac
 
+          echo "=== Deploy parameters ==="
+          echo "Image: ${{ inputs.image-name }}"
+          echo "SHA: sha-${SHORT_SHA}"
+          echo "Env: ${ENV_TAG}"
+          echo "Deploy paths: ${{ inputs.deploy-paths }}"
+          echo "========================="
+
           git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
           cd wectrl-k8s-cluster
 
@@ -127,15 +167,17 @@ jobs:
           git config user.name "Gitea CI"
 
           for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
+            echo "Processing: ${DEPLOY_PATH}"
             yq -i '.spec.template.metadata.annotations."deploy.wectrl.net/restart" = "'"${TIMESTAMP}-sha-${SHORT_SHA}"'"' \
               "${DEPLOY_PATH}"
             git add "${DEPLOY_PATH}"
           done
 
           if git diff --staged --quiet; then
-            echo "No annotation changes to commit"
-          else
+            echo "ERROR: No annotation changes to commit — this should not happen"
+            exit 1
+          fi
+
           git commit -m "deploy: ${{ inputs.service-name }} ${ENV_TAG} (sha-${SHORT_SHA})"
           git push origin main
           echo "Annotation bumped — ArgoCD will roll pods within ~3 min"
-          fi