fix(ci): address code review findings for parallel deployments

1. postgres-cred.yaml in-place edit race: configure_external_postgres_db
   now patches a temp copy instead of editing the shared template via
   sed_inplace. Same class of bug fixed in apply_yaml_files.

2. Unquoted ${NAME_SPACE} in namespace::configure calls: quote both
   occurrences (lines 553, 721) to prevent word-splitting.

3. mktemp in helm::merge_values overwrite path: move mktemp + trap
   inside the "merge" branch so the "overwrite" path doesn't create
   and immediately discard two unused temp files.

4. Remove redundant "Waiting for parallel deployments" log::section
   that fires right before the blocking wait calls — the bookend
   sections are sufficient.

Author: gustavolira

.ci/pipelines/lib/helm.sh

@@ -39,13 +39,13 @@ helm::merge_values() {
     return 1
   fi
 
-  # Use unique temp files per invocation to support parallel deployments
-  local step_1_file step_2_file
-  step_1_file=$(mktemp "${TMPDIR:-/tmp}/helm-merge-step1-XXXXXX.yaml")
-  step_2_file=$(mktemp "${TMPDIR:-/tmp}/helm-merge-step2-XXXXXX.yaml")
-  trap 'rm -f "${step_1_file}" "${step_2_file}"' RETURN
-
   if [[ "$plugin_operation" == "merge" ]]; then
+    # Temp files only needed for the merge path; overwrite writes directly to final_file
+    local step_1_file step_2_file
+    step_1_file=$(mktemp "${TMPDIR:-/tmp}/helm-merge-step1-XXXXXX.yaml")
+    step_2_file=$(mktemp "${TMPDIR:-/tmp}/helm-merge-step2-XXXXXX.yaml")
+    trap 'rm -f "${step_1_file}" "${step_2_file}"' RETURN
+
     # Step 1: Merge files, excluding the .global.dynamic.plugins key
     # Values from `diff_file` override those in `base_file`
     yq eval-all '

.ci/pipelines/utils.sh

@@ -571,7 +571,7 @@ base_deployment() {
   common::require_vars "RELEASE_NAME" "TAG_NAME" "IMAGE_REGISTRY" "IMAGE_REPO" "K8S_CLUSTER_ROUTER_BASE" || return 1
   local artifacts_subdir=$1
 
-  namespace::configure ${NAME_SPACE}
+  namespace::configure "${NAME_SPACE}"
 
   deploy_redis_cache "${NAME_SPACE}"
 
@@ -701,7 +701,6 @@ _run_parallel_deployments() {
   local rbac_pid=$!
   log::info "RBAC deployment started in background (PID: ${rbac_pid})"
 
-  log::section "Waiting for parallel deployments to complete..."
   local base_rc=0 rbac_rc=0
   wait "${base_pid}" || base_rc=$?
   wait "${rbac_pid}" || rbac_rc=$?
@@ -739,7 +738,7 @@ base_deployment_osd_gcp() {
   common::require_vars "RELEASE_NAME" "TAG_NAME" "IMAGE_REGISTRY" "IMAGE_REPO" "K8S_CLUSTER_ROUTER_BASE" || return 1
   local artifacts_subdir=$1
 
-  namespace::configure ${NAME_SPACE}
+  namespace::configure "${NAME_SPACE}"
 
   deploy_redis_cache "${NAME_SPACE}"