From cc86a74dc52911aa3511079bddb9c741d3d683b9 Mon Sep 17 00:00:00 2001
From: Mathias <mthbqv@gmail.com>
Date: Thu, 17 Sep 2026 07:09:14 +0200
Subject: [PATCH] fix(ci): stop the tag push from re-deploying, and make the
 infra bump idempotent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two runs of the full build+deploy fired for every push, and the second died:

    nothing to commit, working tree clean
    ❌  Failure - Main Update infra repo

The deploy was fine both times — the second run had nothing left to do. The
cause is the pair of triggers meeting: ci.yml ran on `push` to main AND on a
`v*` tag, and cd.yml keys off "CI succeeded", so `git push origin main` followed
by `git push origin refs/tags/vX` produced two CI runs for one sha and two
deploys behind them. The tag run carries the same github.sha, so it rebuilt the
same image and then found the infra manifest already pointing at it.

Nothing consumed the tag-triggered run: there is no release workflow, and cd.yml
reads github.sha rather than the tag. Dropping `tags:` removes the duplicate
build outright.

The idempotency guard stays anyway, because a manual re-run has the same shape
and should not ring the CI-red alarm for work that is already done — infra#366
turns a red run into a tracked issue, so a false red costs a real triage.

Closes #118

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .gitea/workflows/cd.yml | 18 +++++++++++++-----
 .gitea/workflows/ci.yml |  7 ++++++-
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 1bf9c3c..a56696c 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -81,11 +81,19 @@ jobs:
           git config user.email "cd-bot@d-ma.be"
           git config user.name "CD Bot"
           git add "k3s/apps/supervisor/ingestion-deployment.yaml"
-          git commit -m "chore(deploy): ingestion → ${IMAGE_TAG}"
-          GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
-            git push
-
-          echo "Infra repo updated: ingestion → ${IMAGE_TAG}"
+          # Idempotent: `git commit` exits 1 on an empty index, so a run that
+          # finds the bump already applied failed the whole job and rang the
+          # CI-red alarm for a deploy that was fine (hyperguild#118). Two
+          # sources of a no-op run: a manual re-run, and the tag-push CI run
+          # that used to shadow the branch-push one for the same sha.
+          if git diff --cached --quiet; then
+            echo "Infra already at ${IMAGE_TAG} — nothing to commit"
+          else
+            git commit -m "chore(deploy): ingestion → ${IMAGE_TAG}"
+            GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
+              git push
+            echo "Infra repo updated: ingestion → ${IMAGE_TAG}"
+          fi
 
       - name: Trigger Flux reconcile (immediate)
         run: |
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4011a8d..f0de45f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -2,8 +2,13 @@ name: CI
 
 "on":
   push:
+    # Branch only. A `v*` tag here points at a commit main already tested, so
+    # the tag push re-ran the whole gate and — because cd.yml keys off "CI
+    # succeeded" — triggered a SECOND full image build and deploy for the same
+    # sha. That second deploy then died on "nothing to commit" (hyperguild#118).
+    # Nothing consumes a tag-triggered run: there is no release workflow, and
+    # cd.yml reads github.sha, not the tag.
     branches: [main]
-    tags: ["v*"]
   pull_request:
     branches: [main]