update to argo deploy method

.gitea/workflows/build-docker-images.yml

@@ -2,134 +2,98 @@ name: Build Hugo
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
+
+# Serialize blog publishes so builds cannot update its desired image at once.
+# Other apps may still push to GitOps, so the push step also handles that race.
+concurrency:
+  group: blog-publish
+  cancel-in-progress: false
 
 env:
   REGISTRY: tea.ahmza.com
-  IMAGE_NAME: ${{ gitea.repository }}
+  IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com
 
 jobs:
   build:
     runs-on: ubuntu-latest
-
     permissions:
       contents: read
       packages: write
-      attestations: write
-      id-token: write
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Check GitOps update helper
+        run: python3 -m unittest discover -s .gitea/tests -v
 
       - name: Login to Gitea Container Registry
-        uses: docker/login-action@v3
+        # Pin the v3 release ref so an upstream tag move cannot change CI code.
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ gitea.repository_owner }}
           password: ${{ secrets.GITEATOKEN }}
 
-      # QEMU deliberately omitted.
-      #
-      # Hugo runs on BUILDPLATFORM in the Dockerfile, so the static site is
-      # built natively on the runner. The final amd64/arm64 stages only copy
-      # the resulting static files into the target-platform SWS image.
+      # Hugo runs on BUILDPLATFORM; runtime stages only copy static files.
+      # Both amd64 and arm64 images therefore build without QEMU emulation.
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        # v3, pinned to an immutable commit.
+        # yamllint disable-line rule:line-length
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        id: build
+        # v6, pinned to an immutable commit.
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
         with:
           context: .
-          platforms: linux/arm64, linux/amd64
+          platforms: linux/arm64,linux/amd64
           push: true
           tags: |
-            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
-            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
-  deploy:
-    runs-on: ubuntu-latest
-    needs: build
+            ${{ env.IMAGE }}:latest
+            ${{ env.IMAGE }}:${{ gitea.sha }}
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max
 
-    steps:
-      - name: Pre-flight - verify VPN prerequisites
-        # NetBird brings up a WireGuard interface, which needs a TUN device and
-        # NET_ADMIN inside the job container. Without them, `netbird up` hangs
-        # ~50s and dies with a cryptic "DeadlineExceeded". Check up front so the
-        # failure is obvious and points at the fix (runner config.yaml).
+      - name: Check out cluster GitOps repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+        with:
+          repository: ahmza.com/k8s-starter-pack
+          ref: main
+          # This credential writes only GitOps, separately from registry access.
+          token: ${{ secrets.GITOPS_TOKEN }}
+          path: _gitops
+
+      - name: Record the published image in Git
+        env:
+          BUILD_DIGEST: ${{ steps.build.outputs.digest }}
+          SOURCE_SHA: ${{ gitea.sha }}
         run: |
-          echo "::group::NetBird prerequisites"
-          if [ -e /dev/net/tun ]; then
-            echo "OK: /dev/net/tun present"
-          else
-            echo "::error title=Missing TUN device::/dev/net/tun not found. Add --device=/dev/net/tun to the runner's config.yaml container.options."
-            exit 1
+          set -eu
+          deploy_image="${IMAGE}@${BUILD_DIGEST}"
+          python3 .gitea/scripts/update_gitops_image.py \
+            _gitops/apps/blog-ahmza-com/deployment.yaml "$deploy_image"
+
+          cd _gitops
+          if git diff --quiet -- apps/blog-ahmza-com/deployment.yaml; then
+            echo "GitOps already references $deploy_image"
+            exit 0
           fi
-          if command -v capsh >/dev/null 2>&1; then
-            capsh --print | grep -q 'cap_net_admin' \
-              && echo "OK: NET_ADMIN present" \
-              || echo "::warning title=NET_ADMIN missing::netbird up will likely time out (DeadlineExceeded) configuring wt0. Add --cap-add=NET_ADMIN to the runner's config.yaml container.options."
-          else
-            echo "note: capsh unavailable, skipping NET_ADMIN check"
-          fi
-          echo "::endgroup::"
+          git config user.name "gitea-actions[bot]"
+          git config user.email "gitea-actions[bot]@tea.ahmza.com"
+          git add apps/blog-ahmza-com/deployment.yaml
+          git commit -m "Deploy blog ${SOURCE_SHA}"
 
-      - name: Netbird Connect
-        id: netbird
-        timeout-minutes: 3
-        uses: Alemiz112/netbird-connect@v1
-        with:
-          setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
-          hostname: 'gitea-actions-blog'
-          management-url: ${{ secrets.NETBIRD_URL }}
-
-      - name: NetBird status
-        # Surface the actual peer/route state in the log and hard-assert that
-        # the management connection is up before attempting any deploys.
-        run: |
-          echo "::group::netbird status"
-          sudo netbird status --detail || true
-          echo "::endgroup::"
-          sudo netbird status | grep -q 'Management: Connected' \
-            && echo "NetBird management connected." \
-            || { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
-
-      - name: Deploy image to talos-prod
-        uses: actions-hub/kubectl@v1.36.2
-        env:
-          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
-        with:
-          args: >-
-            -n blog-ahmza-com
-            set image deployment/blog
-            blog=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
-
-      - name: Wait for rollout
-        uses: actions-hub/kubectl@v1.36.2
-        env:
-          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
-        with:
-          args: >-
-            -n blog-ahmza-com
-            rollout status deployment/blog
-            --timeout=5m
-
-      - name: Show deployed pods
-        uses: actions-hub/kubectl@v1.36.2
-        env:
-          KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
-        with:
-          args: >-
-            -n blog-ahmza-com
-            get pods -o wide
-
-      - name: NetBird diagnostics & disconnect
-        # Runs even on failure: captures final state for debugging and tears the
-        # peer down so stale 'gitea-actions-blog' peers don't pile up.
-        if: always()
-        run: |
-          echo "::group::final netbird status"
-          sudo netbird status --detail || echo "netbird unavailable"
-          echo "::endgroup::"
-          sudo netbird down || true
+          # Rebase unrelated app updates; do not force-push or ignore conflicts.
+          for attempt in 1 2 3; do
+            if git push origin HEAD:main; then
+              exit 0
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "GitOps push failed after three attempts" >&2
+              exit 1
+            fi
+            git pull --rebase origin main
+          done