From e4fed02809e891fd40a52935f9bc058c58f20c16 Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Sat, 26 Sep 2026 19:04:53 +0800
Subject: [PATCH] fix(ci): use namespace-scoped kubeconfig check, guard empty
 pod name

- Replace 'kubectl get nodes' (cluster-scope, forbidden for ci-tekton-trigger SA)
  with 'kubectl get namespaces' (namespace-scoped, allowed)
- Guard canary cleanup against empty POD_NAME to prevent 'resource name may not be empty'

Fixes CI run #1023
---
 .gitea/workflows/ci.yaml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 53e6ca3..e6c5ac3 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -67,7 +67,7 @@ jobs:
         run: |
           mkdir -p ~/.kube
           echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-          kubectl get nodes --no-headers | head -1
+          kubectl get namespaces --no-headers | head -1
           echo '✓ kubeconfig works'
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
@@ -157,8 +157,12 @@ jobs:
         if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           POD_NAME="${{ steps.canary.outputs.pod_name }}"
-          kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
-          echo "✓ Canary pod removed"
+          if [ -n "${POD_NAME}" ]; then
+            kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
+            echo "✓ Canary pod removed"
+          else
+            echo "⚠ No canary pod to clean up (name was empty)"
+          fi
 
       - name: Gate on test result
         if: github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.tests.outputs.result != 'pass'