ci-templates/.gitea/workflows/deploy-k8s.yaml

# Reusable workflow: Update image tag in wectrl-k8s-cluster repo (GitOps deploy)
# Usage: uses: wectrl-net/ci-templates/.gitea/workflows/deploy-k8s.yaml@main
name: Deploy to K8s (GitOps)

on:
  workflow_call:
    inputs:
      image-name:
        description: "Full image name (e.g. git.wectrl.net/wectrl-net/my-service)"
        required: true
        type: string
      deploy-paths:
        description: "Space-separated paths to deployment manifests in the k8s cluster repo"
        required: true
        type: string
      service-name:
        description: "Service name for commit message (e.g. h1per-pms)"
        required: true
        type: string
      k8s-repo:
        description: "K8s cluster repo (org/repo)"
        required: false
        type: string
        default: "wectrl-net/wectrl-k8s-cluster"
      use-env-tag:
        description: "If true, skip SHA-based manifest update (service uses mutable env tags with imagePullPolicy: Always)"
        required: false
        type: boolean
        default: false
    secrets:
      GIT_USER:
        required: true
      GIT_TOKEN:
        required: true

jobs:
  deploy:
    name: Update k8s Cluster Repo
    runs-on: ubuntu-latest
    if: gitea.ref == 'refs/heads/main' && !inputs.use-env-tag
    steps:
      - name: Install yq
        shell: bash
        run: |
          set -euo pipefail
          ARCH=$(uname -m)
          case "$ARCH" in
            aarch64|arm64) YQ_ARCH="arm64" ;;
            x86_64|amd64)  YQ_ARCH="amd64" ;;
            *)             YQ_ARCH="amd64" ;;
          esac
          wget -qO /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_${YQ_ARCH}"
          chmod +x /usr/local/bin/yq

      - name: Update image tag in cluster repo
        shell: bash
        run: |
          set -euo pipefail

          SHA="${{ gitea.sha }}"
          SHORT_SHA="${SHA:0:7}"
          IMAGE_TAG="sha-${SHORT_SHA}"
          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"

          echo "=== Deploy parameters ==="
          echo "Image: ${{ inputs.image-name }}"
          echo "Tag: ${IMAGE_TAG}"
          echo "Deploy paths: ${{ inputs.deploy-paths }}"
          echo "K8s repo: ${{ inputs.k8s-repo }}"
          echo "========================="

          git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
          cd wectrl-k8s-cluster

          git config user.email "ci@wectrl.net"
          git config user.name "Gitea CI"

          MATCHED=0
          for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
            echo "Processing: ${DEPLOY_PATH}"

            # Show current image before update
            CURRENT_IMAGE=$(yq '.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))' "${DEPLOY_PATH}" 2>/dev/null || true)
            if [ -z "${CURRENT_IMAGE}" ]; then
              echo "ERROR: No container image matching '${{ inputs.image-name }}:*' found in ${DEPLOY_PATH}"
              echo "Images in file:"
              yq '.spec.template.spec.containers[].image' "${DEPLOY_PATH}" || true
              exit 1
            fi
            echo "  Current: ${CURRENT_IMAGE}"

            yq -i '(.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))) = "${{ inputs.image-name }}:'"${IMAGE_TAG}"'"' \
              "${DEPLOY_PATH}"

            # Verify the update took effect
            UPDATED_IMAGE=$(yq '.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))' "${DEPLOY_PATH}")
            echo "  Updated: ${UPDATED_IMAGE}"
            if [ "${UPDATED_IMAGE}" != "${{ inputs.image-name }}:${IMAGE_TAG}" ]; then
              echo "ERROR: Image tag update failed for ${DEPLOY_PATH}"
              exit 1
            fi

            MATCHED=$((MATCHED + 1))
            git add "${DEPLOY_PATH}"
          done

          echo "Successfully updated ${MATCHED} manifest(s)"

          if git diff --staged --quiet; then
            echo "ERROR: No image tag changes to commit — manifests may already be at ${IMAGE_TAG}"
            exit 1
          fi

          git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}"
          git push origin main
          echo "Cluster repo updated — ArgoCD will sync within ~3 min"

  # When using mutable env tags, bump a deploy annotation so ArgoCD detects the change
  notify-argocd:
    name: Bump deploy annotation
    runs-on: ubuntu-latest
    if: inputs.use-env-tag
    steps:
      - name: Install yq
        shell: bash
        run: |
          set -euo pipefail
          ARCH=$(uname -m)
          case "$ARCH" in
            aarch64|arm64) YQ_ARCH="arm64" ;;
            x86_64|amd64)  YQ_ARCH="amd64" ;;
            *)             YQ_ARCH="amd64" ;;
          esac
          wget -qO /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_${YQ_ARCH}"
          chmod +x /usr/local/bin/yq

      - name: Bump annotation in cluster repo
        shell: bash
        run: |
          set -euo pipefail

          SHA="${{ gitea.sha }}"
          SHORT_SHA="${SHA:0:7}"
          TIMESTAMP="$(date -u +%Y%m%d%H%M%S)"
          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"

          # Determine env from branch
          REF="${{ gitea.ref }}"
          case "$REF" in
            refs/heads/main|refs/heads/master) ENV_TAG="prod" ;;
            refs/heads/staging) ENV_TAG="staging" ;;
            refs/heads/dev) ENV_TAG="dev" ;;
            *) echo "Branch not mapped to environment, skipping"; exit 0 ;;
          esac

          echo "=== Deploy parameters ==="
          echo "Image: ${{ inputs.image-name }}"
          echo "SHA: sha-${SHORT_SHA}"
          echo "Env: ${ENV_TAG}"
          echo "Deploy paths: ${{ inputs.deploy-paths }}"
          echo "========================="

          git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
          cd wectrl-k8s-cluster

          git config user.email "ci@wectrl.net"
          git config user.name "Gitea CI"

          for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
            echo "Processing: ${DEPLOY_PATH}"
            yq -i '.spec.template.metadata.annotations."deploy.wectrl.net/restart" = "'"${TIMESTAMP}-sha-${SHORT_SHA}"'"' \
              "${DEPLOY_PATH}"
            git add "${DEPLOY_PATH}"
          done

          if git diff --staged --quiet; then
            echo "ERROR: No annotation changes to commit — this should not happen"
            exit 1
          fi

          git commit -m "deploy: ${{ inputs.service-name }} ${ENV_TAG} (sha-${SHORT_SHA})"
          git push origin main
          echo "Annotation bumped — ArgoCD will roll pods within ~3 min"