From 670325e519476e0f2b38b5a58b869ea3270c2e4f Mon Sep 17 00:00:00 2001 From: Mathias Date: Tue, 25 Aug 2026 17:25:25 +0200 Subject: [PATCH] ci(deploy): refuse to patch a manifest with an empty IMAGE_TAG (infra#311) On 2026-08-25 a deploy job ran with an empty IMAGE_TAG, wrote `image: localhost:5000/gitea-mcp:` into the infra repo and pushed it. That is invalid YAML, so Flux failed the ENTIRE apps Kustomization -- every app stopped reconciling for about an hour, including three unrelated deploys queued behind it. This job's existing check could not catch it. It greps for `image: :${IMAGE_TAG}` after the sed, and with IMAGE_TAG empty that pattern matches the corrupted line itself, so the verification passes because of the bug rather than despite it. Asserting the input up front is the fix: an empty tag now fails the job before anything is written, let alone committed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf --- .gitea/workflows/cd.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml index 5cf6d5c..1bf9c3c 100644 --- a/.gitea/workflows/cd.yml +++ b/.gitea/workflows/cd.yml @@ -45,6 +45,12 @@ jobs: set -e trap 'rm -rf /tmp/infra-update; rm -f ~/.ssh/infra_deploy_key' EXIT IMAGE_TAG="${{ github.sha }}" + # infra#311: github.sha is never empty in practice, but the manifest + # patch below is the same shape that took Flux down estate-wide on + # 2026-08-25 -- an empty tag yields `image: :`, which is invalid + # YAML and fails the ENTIRE Kustomization, not just this app. The + # assert costs nothing and removes the class. + [ -n "${IMAGE_TAG:-}" ] || { echo "IMAGE_TAG is empty - refusing to patch"; exit 1; } mkdir -p ~/.ssh echo "${{ secrets.INFRA_DEPLOY_KEY }}" > ~/.ssh/infra_deploy_key chmod 600 ~/.ssh/infra_deploy_key