From 6f1e0be09b43bf2bc27543ff71174f095311418b Mon Sep 17 00:00:00 2001 From: Mathias Date: Tue, 25 Aug 2026 17:25:24 +0200 Subject: [PATCH] ci(deploy): refuse to patch a manifest with an empty IMAGE_TAG (infra#311) On 2026-08-25 a deploy job ran with an empty IMAGE_TAG, wrote `image: localhost:5000/gitea-mcp:` into the infra repo and pushed it. That is invalid YAML, so Flux failed the ENTIRE apps Kustomization -- every app stopped reconciling for about an hour, including three unrelated deploys queued behind it. This job's existing check could not catch it. It greps for `image: :${IMAGE_TAG}` after the sed, and with IMAGE_TAG empty that pattern matches the corrupted line itself, so the verification passes because of the bug rather than despite it. Asserting the input up front is the fix: an empty tag now fails the job before anything is written, let alone committed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf --- .gitea/workflows/ci.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index af3c46c..5fa1296 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -119,6 +119,13 @@ jobs: DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }} run: | set -euo pipefail + # infra#311: fail on an empty tag BEFORE patching anything. The + # grep verification further down CANNOT catch it -- with IMAGE_TAG + # empty its pattern matches the very corruption it exists to reject. + # The result is `image: :` in the manifest, which is invalid + # YAML, so Flux fails the ENTIRE apps Kustomization and every app + # stops reconciling, not just this one. That happened on 2026-08-25. + [ -n "${IMAGE_TAG:-}" ] || { echo "IMAGE_TAG is empty - refusing to patch"; exit 1; } # INFRA_DEPLOY_KEY is a Gitea org secret (mathias org), already # configured per docs/cd-pipeline.md in the infra repo — same key