From f4e60c5d232a580068e37153cd81af3d8e98f648 Mon Sep 17 00:00:00 2001
From: Henrik Brautaset Aronsen <henrik.brautaset.aronsen@entur.org>
Date: Fri, 12 Jun 2026 15:45:23 +0200
Subject: [PATCH] chore: run amazing-app-containers fixture pod as uid 101

The common chart's containers-array path ignores uid in containers[]
entries; the pod securityContext only reads container.uid (singular)
and fell back to the default 1000, which getting-started:latest cannot
run as. This made test-deploy-ok-gcp-containers crash-loop and fail CI
on every PR since the container_name feature was released in 1.6.0
(the feature's own PR ran the pre-release helm-deploy@v1 action, so
the test never actually exercised the replacement).

Also fix the rollback CI test, which broke once the containers test
passed and CI progressed to it. The test calls the helm-deploy
composite action directly, which bypasses deploy.yml's set-values-file
step, so the values input stayed at its literal default "values" and
the bad-image deploy failed on a missing env/values file instead of on
the bad image. No failed revision was created, so the rollback was
non-deterministic (status 2 vs 3) depending on leftover revisions in
the shared amazing-app release. Resolve the dev values file explicitly
so the deploy fails on the bad image and rolls back to the healthy
previous revision (status 2). Assert status 2 (was a stale status 3
left over from the deleted helm-deploy@negative_test action branch),
restore the test-deploy-gcp-with-rollback job name, and make cleanup
idempotent with --ignore-not-found.
---
 .github/workflows/ci.yml                       | 18 ++++++++++++------
 .../helm/amazing-app-containers/values.yaml    |  8 ++++++++
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c2b6b1..cf3372e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -135,7 +135,7 @@ jobs:
       slack_channel_id: GFBL95A0J # sandbox-channel
     secrets: inherit
 
-  test-deploy-gcp-with-failed-rollback:
+  test-deploy-gcp-with-rollback:
     needs: [test-deploy-ok-gcp]
     runs-on: ubuntu-24.04
     environment: dev
@@ -166,17 +166,23 @@ jobs:
           image: mybadimage:dummy
           release_name: amazing-app
           chart: fixture/helm/amazing-app
+          # Calling the composite action directly bypasses deploy.yml's
+          # set-values-file step, so resolve the dev values file explicitly.
+          # Without this the deploy fails on a missing values file instead of
+          # the bad image, so no failed revision is created and the rollback
+          # is non-deterministic (status 2 vs 3) depending on leftover state.
+          values: values-kub-ent-dev.yaml
           namespace: gha-ci
       - name: Check if rollback did succeed
-        if: steps.helm-deploy.outputs.HELM_DEPLOY_STATUS != '3'
+        if: steps.helm-deploy.outputs.HELM_DEPLOY_STATUS != '2'
         uses: actions/github-script@v9
         with:
           script: |
-            core.setFailed('Rollback should fail.')
+            core.setFailed('Rollback did not succeed.')
 
   test-deploy-gcp-no-image-update:
-    if: (success() || failure()) && needs.test-deploy-gcp-with-failed-rollback.result == 'success'
-    needs: [test-deploy-gcp-with-failed-rollback]
+    if: (success() || failure()) && needs.test-deploy-gcp-with-rollback.result == 'success'
+    needs: [test-deploy-gcp-with-rollback]
     uses: ./.github/workflows/deploy.yml
     concurrency:
       group: ${{ github.head_ref }}-gcp
@@ -212,7 +218,7 @@ jobs:
           cloud_provider: gcp
       - id: clean
         run: |
-          helm uninstall amazing-app -n gha-ci
+          helm uninstall amazing-app -n gha-ci --ignore-not-found
 
   test-deploy-ok-azure:
     needs: [test-lint-ok-azure]
diff --git a/fixture/helm/amazing-app-containers/values.yaml b/fixture/helm/amazing-app-containers/values.yaml
index 730f664..03c401e 100644
--- a/fixture/helm/amazing-app-containers/values.yaml
+++ b/fixture/helm/amazing-app-containers/values.yaml
@@ -4,6 +4,14 @@ common:
   team: example
   ingress:
     trafficType: public
+  # Before common v2.0.0 the pod securityContext read only container.uid
+  # (singular); uid on containers[] entries was ignored, so the pod ran as the
+  # default uid 1000 and getting-started:latest crash-loops as 1000 (a
+  # /var/cache/nginx permission error). containers[].uid is honored from
+  # v2.0.0 on — remove this container.uid once this fixture's common dependency
+  # is bumped to a release that includes that fix.
+  container:
+    uid: 101
   containers:
     - name: app
       uid: 101