feat: add deploy job to Zarf workflow with pre/post verification - #7
Merged
Conversation
Adds a second job 'deploy' that runs after the package job on every workflow_run trigger (post-merge to main). It: 1. Downloads the Zarf tarball artifact produced by the package job 2. Captures the pre-deploy state (running image tags) as a step summary 3. Deploys the tarball with `zarf package deploy` 4. Applies post-deploy fixes (namespace label, registry secret, rollout restart) 5. Asserts both deployments are running the expected sha- tag — fails if not Also documents the two recommended approaches for true air-gap delivery (object storage handoff and USB transfer) as inline TODO comments. Requires KUBECONFIG_B64 secret: base64-encoded kubeconfig with access to the target cluster. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Runs `zarf dev lint` on every PR that modifies zarf.yaml or helm/airgapped-demo/. Validates schema, chart paths, variable declarations, and template syntax without pulling images or requiring registry credentials. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
deployjob tozarf-package.ymlthat runs automatically after every successful package build onmain.What it does:
packagejobzarf package deployagainst the target clustersha-XXXXXXXtag — the step fails if there's a mismatchArchitecture note (TODOs documented inline)
The deploy job as written assumes the runner can reach the cluster directly (e.g. via a self-hosted runner or VPN). For a real air-gap two approaches are documented as TODO comments in the workflow:
ZARF.md § Air-Gap USB Deployment.Required secret
KUBECONFIG_B64— base64-encoded kubeconfig with access to the target cluster:E2E validation (done manually this session)
localhost:5001/.../backend:dev...ecr.../backend:sha-13b0a93/api/itemscountk3s readyk3s ready · E2E validation ✓🤖 Generated with Claude Code