From 583d8f8f25dbe2f03616e94e11f5af3bd555e2af Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <sharang@breakpilot.com>
Date: Sun, 30 Aug 2026 21:10:33 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20the=20image=20job=20never=20ran=20?=
 =?UTF-8?q?=E2=80=94=20fix=20condition,=20tag=20:latest,=20deploy=20for=20?=
 =?UTF-8?q?real=20(#16)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/ci.yaml | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 0ec4dee..405a894 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -94,7 +94,10 @@ jobs:
 
   image:
     needs: [shared, test]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && hashFiles('Dockerfile') != ''
+    # NOTE: no hashFiles() here — at job level it evaluates BEFORE checkout
+    # against an empty workspace, so the old condition was always false and
+    # this job silently never ran (deployment sat on an Aug-06 image).
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
@@ -110,13 +113,26 @@ jobs:
           push: true
           tags: |
             repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:sha-${{ github.sha }}
-            repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:env-stage
+            repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:latest
 
       - uses: anchore/sbom-action@v0
         with:
           image: repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:sha-${{ github.sha }}
 
-      - name: orca deploy stage
-        run: orca apply --env=stage --image-tag=sha-${{ github.sha }}
+      # Notify orca to pull :latest and recreate the service (same pattern as
+      # breakpilot-core/build-pitch-deck.yml). The stage-env deploy this used to
+      # attempt does not exist in this cluster.
+      - name: orca deploy webhook
         env:
-          ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
+          ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
+          ORCA_WEBHOOK_URL: http://46.225.100.82:6880/api/v1/webhooks/github
+        run: |
+          set -euo pipefail
+          PAYLOAD="{\"ref\":\"refs/heads/main\",\"repository\":{\"full_name\":\"${GITHUB_REPOSITORY}\"},\"head_commit\":{\"id\":\"${GITHUB_SHA}\",\"message\":\"ci: tenant-registry image build\"}}"
+          SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -r | awk '{print $1}')
+          curl -sSf -k \
+            -H "Content-Type: application/json" \
+            -H "X-GitHub-Event: push" \
+            -H "X-Hub-Signature-256: sha256=$SIG" \
+            -d "$PAYLOAD" \
+            "$ORCA_WEBHOOK_URL"