From f89e312b05734c55c1c1c5fbe7bcb944d068ff82 Mon Sep 17 00:00:00 2001 From: jasonwitty Date: Sun, 26 Jul 2026 03:28:46 -0700 Subject: [PATCH] Fail fast with a clear error when KUBECONFIG secret is missing An unset secret expands to empty, base64 -d writes a zero-byte kubeconfig, and kubectl falls back to localhost:8080 with a misleading connection error. Guard both jobs and echo the current context after configuring. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/deploy.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml index 140813c..c93a351 100644 --- a/.gitea/workflows/deploy.yaml +++ b/.gitea/workflows/deploy.yaml @@ -32,9 +32,14 @@ jobs: - name: Configure kubectl run: | + if [ -z "${{ secrets.KUBECONFIG }}" ]; then + echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080." + exit 1 + fi mkdir -p $HOME/.kube echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config chmod 600 $HOME/.kube/config + kubectl config current-context - name: Server-side dry-run of full kustomization run: | @@ -65,9 +70,14 @@ jobs: - name: Configure kubectl run: | + if [ -z "${{ secrets.KUBECONFIG }}" ]; then + echo "::error::Repo Actions secret KUBECONFIG is not set (Settings -> Actions -> Secrets). Without it kubectl silently falls back to localhost:8080." + exit 1 + fi mkdir -p $HOME/.kube echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config chmod 600 $HOME/.kube/config + kubectl config current-context - name: Apply kustomization run: |