Run deploy after build-images to fix image pull race (#781)

Author: Rub21

.github/workflows/build-images.yaml

@@ -8,19 +8,17 @@ name: Build images (chartpress)
 # registry before a deploy references them.
 
 on:
+  # Runs on every push, no path filter. This is the single entry point for a
+  # deploy: deploy-eks and deploy-k3s only fire via workflow_run once this
+  # finishes, so the images are always in the registry before a deploy uses
+  # them. chartpress skips the rebuild when nothing under images/** changed
+  # (tags come from git history), so config-only pushes stay cheap.
   push:
     branches:
       - 'main'
       - 'staging'
       - 'deploy-*'
       - 'build-*'
-      - 'k3s'
-    paths:
-      # chartpress.yaml and Chart.yaml are shared deps: changing them rebumps
-      # every image tag, so the build must run to push images at the new tag.
-      - 'images/**'
-      - 'chartpress.yaml'
-      - 'ohm/Chart.yaml'
   workflow_dispatch:
 
 jobs:

.github/workflows/deploy-eks.yaml

@@ -3,12 +3,12 @@ name: Deploy EKS
 # Deploys the ohm/ chart to AWS EKS.
 #
 # Triggers:
-#   - workflow_run: after "Build images (chartpress)" finishes, so the
-#     images are already in ghcr.io before we reference them.
-#   - push (paths-ignore images/**): config-only changes, no build needed.
-#   - workflow_dispatch: manual deploy of a branch. NOTE: for a commit
-#     that changed images/**, build-images must have run first so the
-#     image exists in the registry.
+#   - workflow_run: the only automatic trigger. A push runs build-images
+#     first, which triggers this on success, so the images are always in
+#     ghcr.io before we use them — even when a commit changes both config
+#     and images.
+#   - workflow_dispatch: manual deploy of a branch. For a commit that changed
+#     images/**, build-images must have run first so the image exists.
 #
 # The deploy runs `chartpress --skip-build` itself to rewrite the
 # image tags in ohm/values.yaml. The tags are derived from git history,
@@ -19,20 +19,10 @@ on:
   workflow_run:
     workflows: ['Build images (chartpress)']
     types: [completed]
-    branches:
-      - main
-      - staging
-  push:
     branches:
       - main
       - staging
       - deploy-*
-    # images/**, chartpress.yaml and Chart.yaml rebump image tags, so they
-    # must go through "Build images" first and reach deploy via workflow_run.
-    paths-ignore:
-      - 'images/**'
-      - 'chartpress.yaml'
-      - 'ohm/Chart.yaml'
   workflow_dispatch:
     inputs:
       ref:

.github/workflows/deploy-k3s.yaml

@@ -1,9 +1,11 @@
 name: Deploy k3s
 
 on:
-  # Images changed: wait for "Build images (chartpress)" to finish, then
-  # deploy. The deploy re-runs `chartpress --skip-build` to recompute the
-  # same tags build pushed (no artifact is passed between workflows).
+  # Deploy only after "Build images (chartpress)" finishes, never on push
+  # directly. A push runs build-images, which triggers this on success. That
+  # way the images always exist in the registry before the deploy uses them,
+  # even when a commit touches both config and images. The deploy re-runs
+  # `chartpress --skip-build` to recompute the same tags build pushed.
   workflow_run:
     workflows: ['Build images (chartpress)']
     types: [completed]
@@ -12,19 +14,6 @@ on:
       - pre-production
       - staging
       - k3s
-  # Config-only changes that do NOT rebump image tags: deploy directly.
-  # images/**, chartpress.yaml and Chart.yaml change tags, so they must go
-  # through "Build images" first and reach deploy via workflow_run.
-  push:
-    branches:
-      - main
-      - pre-production
-      - staging
-      - k3s
-    paths-ignore:
-      - 'images/**'
-      - 'chartpress.yaml'
-      - 'ohm/Chart.yaml'
   workflow_dispatch:
     inputs:
       ref: