update to argo deploy method

.gitea/scripts/update_gitops_image.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Record a built blog image digest without requiring a YAML package in CI."""
+
+import re
+import sys
+from pathlib import Path
+
+REPOSITORY = "tea.ahmza.com/ahmza/blog-ahmza-com"
+DIGEST_IMAGE = re.compile(re.escape(REPOSITORY) + r"@sha256:[0-9a-f]{64}\Z")
+IMAGE_LINE = re.compile(
+    r"(?m)^(?P<prefix> +image: )"
+    + re.escape(REPOSITORY)
+    + r"(?::[A-Za-z0-9_][A-Za-z0-9_.-]*|@sha256:[0-9a-f]{64})"
+    + r"(?P<suffix>[ \t]*(?:#[^\n]*)?)$"
+)
+
+
+def update_image(manifest: Path, image: str) -> bool:
+    """Replace exactly one blog image; reject mutable or unexpected image input."""
+    if not DIGEST_IMAGE.fullmatch(image):
+        raise ValueError("expected the blog repository with a sha256 image digest")
+
+    original = manifest.read_text()
+    matches = list(IMAGE_LINE.finditer(original))
+    if len(matches) != 1:
+        raise ValueError(f"expected exactly one blog image line, found {len(matches)}")
+
+    updated = IMAGE_LINE.sub(
+        lambda match: match["prefix"] + image + match["suffix"], original
+    )
+    if updated == original:
+        return False
+    manifest.write_text(updated)
+    return True
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        print("usage: update_gitops_image.py MANIFEST IMAGE@sha256:DIGEST", file=sys.stderr)
+        return 2
+    try:
+        changed = update_image(Path(sys.argv[1]), sys.argv[2])
+    except (OSError, ValueError) as error:
+        print(f"Cannot update GitOps image: {error}", file=sys.stderr)
+        return 1
+    print("GitOps image updated" if changed else "GitOps image already current")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())