ci: skip canary deploy, kubeconfig, and k8s promotion (RBAC not ready) (#41)

- Remove kubectl install from dependencies (nothing uses it now)
- Skip Setup kubeconfig step
- Comment out k8s rolling update promotion
- Tag :latest still works (docker tag+push, no kubectl)
- Re-enable when ci-tekton-trigger SA has pod create/delete RBAC

---------

Co-authored-by: Admin Bot <[email protected]>
Reviewed-on: #41

.gitea/workflows/ci.yaml

@@ -21,9 +21,6 @@ jobs:
         run: |
           apt-get update
           apt-get install -y docker.io curl nodejs
-          curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-          chmod +x kubectl && mv kubectl /usr/local/bin/
-          kubectl version --client
 
       - name: Checkout code
         uses: actions/checkout@v4
@@ -63,17 +60,17 @@ jobs:
       # (Temporal, Gotify). Tests run against its pod IP directly.
       # Zero downtime: production pods untouched until tests pass.
       - name: Setup kubeconfig
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: false  # SKIP: only needed for canary deploy, RBAC not ready
         run: |
           mkdir -p ~/.kube
           echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
-          kubectl get nodes --no-headers | head -1
+          kubectl get namespaces --no-headers | head -1
           echo '✓ kubeconfig works'
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
 
       - name: Deploy canary pod
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: false  # SKIP: SA lacks pod create RBAC. Re-enable when fixed.
         id: canary
         run: |
           SHA="${{ steps.sha.outputs.short_sha }}"
@@ -136,7 +133,7 @@ jobs:
           echo "✓ Canary ready at ${POD_IP}:8080"
 
       - name: Run integration tests against canary
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: false  # SKIP: depends on canary pod
         id: tests
         run: |
           POD_IP="${{ steps.canary.outputs.pod_ip }}"
@@ -154,14 +151,18 @@ jobs:
           echo "result=${RESULT}" >> $GITHUB_OUTPUT
 
       - name: Cleanup canary pod
-        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: false  # SKIP: depends on canary pod
         run: |
           POD_NAME="${{ steps.canary.outputs.pod_name }}"
-          kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
-          echo "✓ Canary pod removed"
+          if [ -n "${POD_NAME}" ]; then
+            kubectl delete pod "${POD_NAME}" -n api --ignore-not-found || true
+            echo "✓ Canary pod removed"
+          else
+            echo "⚠ No canary pod to clean up (name was empty)"
+          fi
 
       - name: Gate on test result
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && steps.tests.outputs.result != 'pass'
+        if: false  # SKIP: depends on canary pod
         run: |
           echo "✗ Integration tests FAILED — production deployment unchanged"
           exit 1
@@ -169,14 +170,12 @@ jobs:
       # ── Zero-downtime promotion ──────────────────────────────
       # kubectl set image triggers a rolling update: new pods come up
       # before old pods are terminated. Production traffic uninterrupted.
-      - name: Promote — rolling update
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: |
-          SHA="${{ steps.sha.outputs.short_sha }}"
-          kubectl set image deployment/api-gateway \
-            api-gateway="${IMAGE}:${SHA}" -n api
-          kubectl rollout status deployment/api-gateway -n api --timeout=120s
-          echo "✓ Rolling update complete: ${IMAGE}:${SHA}"
+      # TODO: Re-enable rolling update when kubeconfig/RBAC is ready
+      # - name: Promote — rolling update
+      #   if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+      #   run: |
+      #     kubectl set image deployment/api-gateway api-gateway="${IMAGE}:${SHA}" -n api
+      #     kubectl rollout status deployment/api-gateway -n api --timeout=120s
 
       - name: Tag :latest (informational)
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'