ci : pls

.gitea/workflows/ci.yml

@@ -78,22 +78,50 @@ jobs:
         uses: azure/setup-kubectl@v4
 
       - name: Configure kubectl
+        env:
+          KUBE_CONFIG_B64: ${{ secrets.KUBE_CONFIG_B64 }}
         run: |
-          kubectl config set-cluster buzz --server=https://100.75.220.33:6443 --insecure-skip-tls-verify=true
-          kubectl config set-credentials ci-deployer --token=${{ secrets.KUBE_TOKEN }}
-          kubectl config set-context buzz --cluster=buzz --user=ci-deployer --namespace=buzz
-          kubectl config use-context buzz
+          if [ -z "$KUBE_CONFIG_B64" ]; then
+            echo "Missing KUBE_CONFIG_B64 secret for the CI deploy identity" >&2
+            exit 1
+          fi
+
+          kube_dir="$RUNNER_TEMP/buzz-sheet-kube"
+          mkdir -p "$kube_dir"
+          chmod 700 "$kube_dir"
+          export KUBECONFIG="$kube_dir/config"
+          printf '%s' "$KUBE_CONFIG_B64" | base64 --decode >"$KUBECONFIG"
+          chmod 600 "$KUBECONFIG"
+
+          env_file="${GITEA_ENV_FILE:-${GITHUB_ENV:-}}"
+          if [ -n "$env_file" ]; then
+            printf '%s\n' "KUBECONFIG=$KUBECONFIG" >> "$env_file"
+          fi
 
       - name: Migrate, then roll out the immutable revision
         env:
           REVISION: ${{ gitea.sha }}
+          KUBE_CONFIG_B64: ${{ secrets.KUBE_CONFIG_B64 }}
         shell: bash
         run: |
           set -Eeuo pipefail
 
-          export KUBECONFIG="${KUBECONFIG:-$RUNNER_TEMP/buzz-sheet-kube/config}"
+          if [ -z "$KUBE_CONFIG_B64" ]; then
+            echo "Missing KUBE_CONFIG_B64 secret for the CI deploy identity" >&2
+            exit 1
+          fi
+
+          kube_dir="$RUNNER_TEMP/buzz-sheet-kube"
+          mkdir -p "$kube_dir"
+          chmod 700 "$kube_dir"
+          export KUBECONFIG="$kube_dir/config"
+          if ! printf '%s' "$KUBE_CONFIG_B64" | base64 --decode >"$KUBECONFIG"; then
+            echo "KUBE_CONFIG_B64 is not valid base64" >&2
+            exit 1
+          fi
+          chmod 600 "$KUBECONFIG"
           if [ ! -s "$KUBECONFIG" ]; then
-            echo "Kubeconfig was not created from KUBE_CONFIG_B64" >&2
+            echo "KUBE_CONFIG_B64 decoded to an empty kubeconfig" >&2
             exit 1
           fi