ci-templates/.gitea/workflows/deploy-k8s.yaml

# Reusable workflow: Update image tag in wectrl-k8s-cluster repo (GitOps deploy)
# Usage: uses: wectrl-net/ci-templates/.gitea/workflows/deploy-k8s.yaml@main
name: Deploy to K8s (GitOps)

on:
  workflow_call:
    inputs:
      image-name:
        description: "Full image name (e.g. git.wectrl.net/wectrl-net/my-service)"
        required: true
        type: string
      deploy-paths:
        description: "Space-separated paths to deployment manifests in the k8s cluster repo"
        required: true
        type: string
      service-name:
        description: "Service name for commit message (e.g. h1per-pms)"
        required: true
        type: string
      k8s-repo:
        description: "K8s cluster repo (org/repo)"
        required: false
        type: string
        default: "wectrl-net/wectrl-k8s-cluster"
      use-env-tag:
        description: "If true, skip SHA-based manifest update (service uses mutable env tags with imagePullPolicy: Always)"
        required: false
        type: boolean
        default: false
    secrets:
      GIT_USER:
        required: true
      GIT_TOKEN:
        required: true

jobs:
  deploy:
    name: Update k8s Cluster Repo
    runs-on: ubuntu-latest
    if: gitea.ref == 'refs/heads/main' && inputs.use-env-tag == false
    steps:
      - name: Install yq
        shell: bash
        run: |
          set -euo pipefail
          ARCH=$(uname -m)
          case "$ARCH" in
            aarch64|arm64) YQ_ARCH="arm64" ;;
            x86_64|amd64)  YQ_ARCH="amd64" ;;
            *)             YQ_ARCH="amd64" ;;
          esac
          wget -qO /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_${YQ_ARCH}"
          chmod +x /usr/local/bin/yq

      - name: Update image tag in cluster repo
        shell: bash
        run: |
          set -euo pipefail

          SHA="${{ gitea.sha }}"
          SHORT_SHA="${SHA:0:7}"
          IMAGE_TAG="sha-${SHORT_SHA}"
          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"

          git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
          cd wectrl-k8s-cluster

          git config user.email "ci@wectrl.net"
          git config user.name "Gitea CI"

          for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
            yq -i '(.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))) = "${{ inputs.image-name }}:'"${IMAGE_TAG}"'"' \
              "${DEPLOY_PATH}"
            git add "${DEPLOY_PATH}"
          done

          if git diff --staged --quiet; then
            echo "No image tag changes to commit"
          else
            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}"
            git push origin main
            echo "Cluster repo updated — ArgoCD will sync within ~3 min"
          fi

  # When using mutable env tags, bump a deploy annotation so ArgoCD detects the change
  notify-argocd:
    name: Bump deploy annotation
    runs-on: ubuntu-latest
    if: inputs.use-env-tag == true
    steps:
      - name: Install yq
        shell: bash
        run: |
          set -euo pipefail
          ARCH=$(uname -m)
          case "$ARCH" in
            aarch64|arm64) YQ_ARCH="arm64" ;;
            x86_64|amd64)  YQ_ARCH="amd64" ;;
            *)             YQ_ARCH="amd64" ;;
          esac
          wget -qO /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_${YQ_ARCH}"
          chmod +x /usr/local/bin/yq

      - name: Bump annotation in cluster repo
        shell: bash
        run: |
          set -euo pipefail

          SHA="${{ gitea.sha }}"
          SHORT_SHA="${SHA:0:7}"
          TIMESTAMP="$(date -u +%Y%m%d%H%M%S)"
          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"

          # Determine env from branch
          REF="${{ gitea.ref }}"
          case "$REF" in
            refs/heads/main|refs/heads/master) ENV_TAG="prod" ;;
            refs/heads/staging) ENV_TAG="staging" ;;
            refs/heads/dev) ENV_TAG="dev" ;;
            *) echo "Branch not mapped to environment, skipping"; exit 0 ;;
          esac

          git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
          cd wectrl-k8s-cluster

          git config user.email "ci@wectrl.net"
          git config user.name "Gitea CI"

          for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
            yq -i '.spec.template.metadata.annotations."deploy.wectrl.net/restart" = "'"${TIMESTAMP}-sha-${SHORT_SHA}"'"' \
              "${DEPLOY_PATH}"
            git add "${DEPLOY_PATH}"
          done

          if git diff --staged --quiet; then
            echo "No annotation changes to commit"
          else
            git commit -m "deploy: ${{ inputs.service-name }} ${ENV_TAG} (sha-${SHORT_SHA})"
            git push origin main
            echo "Annotation bumped — ArgoCD will roll pods within ~3 min"
          fi