renamed the stuff and stuff to do stff on stuff blablabla

.gitea/workflows/build-docker-images.yml

@@ -105,38 +105,73 @@ jobs:
 
       - name: Configure Kubernetes access
         env:
-          KUBE_CONFIG: ${{ secrets.TALOS_PROD_KUBE_CONFIG }}
+          KUBE_CONFIG_B64: ${{ secrets.TALOS_PROD_KUBE_CONFIG }}
         run: |
-          mkdir -p "$HOME/.kube"
+          set -euo pipefail
 
-          printf '%s' "$KUBE_CONFIG" \
+          if [ -z "${KUBE_CONFIG_B64:-}" ]; then
+            echo "::error::KUBE_CONFIG secret is empty or unavailable"
+            exit 1
+          fi
+
+          KUBECONFIG_PATH="${RUNNER_TEMP}/gitea-blog-kubeconfig"
+
+          printf '%s' "$KUBE_CONFIG_B64" \
             | base64 -d \
-            > "$HOME/.kube/config"
+            > "$KUBECONFIG_PATH"
 
-          chmod 600 "$HOME/.kube/config"
+          chmod 600 "$KUBECONFIG_PATH"
+
+          # Make this kubeconfig explicit for every later workflow step.
+          echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV"
+
+          echo "Kubeconfig decoded successfully."
+
+          # Safe diagnostics: these do NOT print the bearer token.
+          echo -n "Context: "
+          KUBECONFIG="$KUBECONFIG_PATH" kubectl config current-context
+
+          echo -n "API server: "
+          KUBECONFIG="$KUBECONFIG_PATH" \
+            kubectl config view --minify \
+            -o jsonpath='{.clusters[0].cluster.server}'
+          echo
 
       - name: Verify Kubernetes access
         run: |
-          kubectl version --client
+          set -euo pipefail
 
-          echo "Deployment patch:"
+          echo "Using kubeconfig: $KUBECONFIG"
+
+          echo -n "API server: "
+          kubectl config view --minify \
+            -o jsonpath='{.clusters[0].cluster.server}'
+          echo
+
+          echo -n "Context: "
+          kubectl config current-context
+
+          echo
+          echo "RBAC checks:"
+
+          printf 'patch deployment: '
           kubectl auth can-i patch deployments \
             -n blog-ahmza-com
 
-          echo "Secret read:"
+          printf 'read secrets:     '
           kubectl auth can-i get secrets \
             -n blog-ahmza-com
 
+          echo
           kubectl -n blog-ahmza-com get deployment blog
 
       - name: Deploy to Kubernetes
         env:
           IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
         run: |
-          set -eu
+          set -euo pipefail
 
-          echo "Deploying:"
-          echo "$IMAGE"
+          echo "Deploying $IMAGE"
 
           kubectl -n blog-ahmza-com \
             set image deployment/blog \
@@ -160,7 +195,6 @@ jobs:
 
           kubectl -n blog-ahmza-com get pods -o wide
 
-
       - name: NetBird diagnostics & disconnect
         # Runs even on failure: captures final state for debugging and tears the
         # peer down so stale 'gitea-actions-blog' peers don't pile up.