zeekayandhanzo-dev 9687c6fcfe feat(ci): pre-promote E2E gate — staging deploy + Playwright gates every prod CR tag bump ...

promote.yml (on: workflow_call) becomes the ONE sanctioned way to bump a
production operator CR image tag. Fail-closed DAG: stage → e2e → promote →
cleanup. `stage` deploys image:tag into a throwaway staging-<svc>-<run_id> ns
with a readinessProbe (never-Ready ⇒ blocked); `e2e` port-forwards the staged
service and runs the repo's Playwright suite (non-empty-body smoke floor when
none exists, never auto-pass); `promote` — the only prod-CR writer — runs iff
stage green AND e2e passed/disabled, does a surgical `yq` .spec.image.tag edit
guarded by a git-numstat==1/1 assertion + read-back, then commits to main;
`cleanup` always deletes the staging ns.

Also: .github/actionlint.yaml declares our self-hosted labels (fixes the
pre-existing "unknown label" warnings repo-wide); docs/PROMOTE_GATE.md + a
RUNNERS.md pointer deprecate hand-editing prod CR tags.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

2026-07-21 20:36:24 -07:00

..

PROMOTE_GATE.md

feat(ci): pre-promote E2E gate — staging deploy + Playwright gates every prod CR tag bump

2026-07-21 20:36:24 -07:00