fix: rewrite Tekton integration tests for X-Service routing

FIXES:
- Remove stale files: k8s/argocd-apps/, k8s/tekton/base/, overlays/
  (Tekton infra is in homelab repo, not here)
- Fix step.resources → step.computeResources (Tekton v1 API)
- Fix Task: use curl sidecar pattern instead of distroless image
  (distroless has no shell/curl/go)
- Fix routing: use X-Service + X-Resource headers, not path-based
- Extract test script to scripts/integration-test.sh (ConfigMap mount)
- Install kubectl in CI runner (was missing)
- Prune README to essentials

TASK ARCHITECTURE:
  sidecar: gateway image (mounts config secret, runs on localhost)
  step: curlimages/curl (runs integration-test.sh from ConfigMap)

TEST COVERAGE:
  health, header validation, memory, s3, sqs, workflow, iam

.gitea/workflows/ci.yaml

@@ -17,10 +17,13 @@ jobs:
     name: CI
     runs-on: golang
     steps:
-      - name: Install Node.js and Docker
+      - name: Install dependencies
         run: |
           apt-get update
-          apt-get install -y nodejs docker.io
+          apt-get install -y docker.io curl
+          curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+          chmod +x kubectl && mv kubectl /usr/local/bin/
+          kubectl version --client
 
       - name: Checkout code
         uses: actions/checkout@v4
@@ -48,90 +51,81 @@ jobs:
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
             -f Dockerfile .
-          echo "Built image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Push test image (SHA tag only, not latest yet)
-        run: |
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          echo "✓ Pushed test image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+      - name: Push image (SHA tag)
+        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Setup kubeconfig for Tekton trigger
+      # ── Tekton integration tests ─────────────────────────────
+      - name: Setup kubeconfig
         run: |
           mkdir -p ~/.kube
           echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
+          kubectl cluster-info
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
-        continue-on-error: true
 
-      - name: Trigger integration tests via Tekton PipelineRun
+      - name: Trigger Tekton PipelineRun
+        id: tekton
         run: |
-          echo "Triggering integration tests via Tekton..."
-          
-          # Create PipelineRun to run integration tests
-          kubectl create -f - << 'YAML'
+          SHA="${{ steps.sha.outputs.short_sha }}"
+          RUN_NAME="integration-test-${SHA}"
+
+          # Clean up any previous run with the same name
+          kubectl delete pipelinerun "${RUN_NAME}" -n api --ignore-not-found
+
+          # Create PipelineRun — spins up gateway sidecar + curl tests
+          cat <<YAML | kubectl create -f -
           apiVersion: tekton.dev/v1
           kind: PipelineRun
           metadata:
-            name: integration-test-${{ steps.sha.outputs.short_sha }}
+            name: ${RUN_NAME}
             namespace: api
             labels:
-              pr-id: "${{ github.event.pull_request.number || 'main' }}"
-              commit-sha: "${{ steps.sha.outputs.short_sha }}"
+              commit-sha: "${SHA}"
           spec:
             pipelineRef:
               name: integration-test-pipeline
             params:
             - name: image
-              value: ${IMAGE}:${{ steps.sha.outputs.short_sha }}
-            - name: test-timeout
-              value: "5m"
+              value: "${IMAGE}:${SHA}"
           YAML
-          
-          echo "✓ PipelineRun created: integration-test-${{ steps.sha.outputs.short_sha }}"
-          
-          # Wait for PipelineRun completion
-          echo "Waiting for tests to complete (max 10 minutes)..."
-          kubectl wait --for=condition=Succeeded \
-            pipelineruns/integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api --timeout=10m 2>/dev/null || \
-          kubectl wait --for=condition=Failed \
-            pipelineruns/integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api --timeout=1s 2>/dev/null || true
-          
-          # Get test results
-          echo ""
-          echo "=== Test Results ==="
-          RESULT=$(kubectl get pipelinerun integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api -o jsonpath='{.status.conditions[0].reason}')
-          TEST_MESSAGE=$(kubectl get pipelinerun integration-test-${{ steps.sha.outputs.short_sha }} \
-            -n api -o jsonpath='{.status.taskRuns[*].status.taskResults[?(@.name=="result")].value}')
-          
-          echo "PipelineRun Status: $RESULT"
-          echo "Test Result: $TEST_MESSAGE"
-          
-          # Get logs
+
+          echo "✓ PipelineRun created: ${RUN_NAME}"
+
+          # Wait for completion (Succeeded or Failed)
+          echo "Waiting for tests (timeout 5m)..."
+          if kubectl wait pipelinerun/"${RUN_NAME}" -n api \
+               --for=condition=Succeeded --timeout=5m 2>/dev/null; then
+            echo "result=pass" >> $GITHUB_OUTPUT
+          else
+            echo "result=fail" >> $GITHUB_OUTPUT
+          fi
+
+          # Print logs + results
           echo ""
           echo "=== Test Logs ==="
-          kubectl logs -n api pipelinerun/integration-test-${{ steps.sha.outputs.short_sha }} || true
-          
-          # Determine if tests passed
-          if [ "$RESULT" = "Succeeded" ]; then
-            echo "✓ Integration tests PASSED"
-            exit 0
-          else
-            echo "✗ Integration tests FAILED"
-            exit 1
-          fi
-        continue-on-error: false
+          kubectl logs -n api "pipelinerun/${RUN_NAME}" --all-containers 2>/dev/null || true
+          echo ""
+          REASON=$(kubectl get pipelinerun "${RUN_NAME}" -n api \
+            -o jsonpath='{.status.conditions[0].reason}')
+          SUMMARY=$(kubectl get pipelinerun "${RUN_NAME}" -n api \
+            -o jsonpath='{.status.results[?(@.name=="test-summary")].value}')
+          echo "Status: ${REASON}"
+          echo "Summary: ${SUMMARY}"
 
-      - name: Promote image to latest (only if tests passed)
-        if: success()
+      - name: Gate on test result
+        if: steps.tekton.outputs.result != 'pass'
+        run: |
+          echo "✗ Integration tests FAILED — image NOT promoted"
+          exit 1
+
+      # ── Promote only after tests pass ────────────────────────
+      - name: Promote image to latest
         run: |
-          docker pull "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
           docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
           docker push "${IMAGE}:latest"
-          echo "✓ Promoted ${IMAGE}:${{ steps.sha.outputs.short_sha }} to latest"
+          echo "✓ Promoted to latest"
 
       - name: Cleanup
         if: always()
-        run: docker image prune -a --force 2>&1 | tail -3 || true
+        run: docker image prune -af 2>&1 | tail -3 || true