From 5efd243972eeb133458ca976b8aa255f1cfbc51b Mon Sep 17 00:00:00 2001
From: ilopez <ilopez1472@gmail.com>
Date: Sun, 14 Jun 2026 21:17:09 -0500
Subject: [PATCH] =?UTF-8?q?fix(ci):=20helm=20collision-proof=20en=20helm-d?=
 =?UTF-8?q?eploy=20(pre-horneado=20+=20fallback=20mktemp=20=C3=BAnico)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Propaga desde coralware/IDP@b31c741 (CI-SHARED-HOME-RACE). El step usa el helm
pre-horneado de la imagen del runner si está presente; el fallback descarga a un
dir único por-run (mktemp), nunca a $HOME/.local/bin ni /tmp/linux-$ARCH
compartidos que con executor=host se pisan entre jobs concurrentes.
---
 .gitea/workflows/APP_NAME-build.yaml | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/APP_NAME-build.yaml b/.gitea/workflows/APP_NAME-build.yaml
index 3c31004..10d213b 100644
--- a/.gitea/workflows/APP_NAME-build.yaml
+++ b/.gitea/workflows/APP_NAME-build.yaml
@@ -164,21 +164,32 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Instalar helm
+      - name: Asegurar helm disponible
+        # helm v3.14.4 viene pre-horneado en la imagen del runner
+        # (infrastructure/ci-system/Dockerfile, igual que kubectl/trivy) → este
+        # step es un no-op de verificación. Fallback para imágenes antiguas:
+        # descarga a un directorio ÚNICO por-run (`mktemp -d`) y lo añade al PATH;
+        # NUNCA escribe a rutas compartidas ($HOME/.local/bin ni /tmp/linux-$ARCH),
+        # que con executor=host se pisan entre jobs concurrentes del mismo runner
+        # (causa raíz del flake first-deploy: "helm: Text file busy" /
+        # "mv: can't rename", CI-SHARED-HOME-RACE, sesión CI 2026-06-16).
         run: |
+          if command -v helm >/dev/null 2>&1; then
+            echo "helm pre-horneado en la imagen: $(helm version --short)"
+            exit 0
+          fi
           HELM_VERSION=v3.14.4
           case "$(uname -m)" in
             x86_64)  ARCH=amd64 ;;
             aarch64) ARCH=arm64 ;;
             *) echo "Arquitectura no soportada: $(uname -m)"; exit 1 ;;
           esac
-          mkdir -p "${HOME}/.local/bin"
+          DEST="$(mktemp -d)"
           curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz" \
-            | tar -xz -C /tmp "linux-${ARCH}/helm"
-          mv "/tmp/linux-${ARCH}/helm" "${HOME}/.local/bin/helm"
-          chmod +x "${HOME}/.local/bin/helm"
-          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
-          "${HOME}/.local/bin/helm" version
+            | tar -xz -C "$DEST" "linux-${ARCH}/helm"
+          chmod +x "${DEST}/linux-${ARCH}/helm"
+          echo "${DEST}/linux-${ARCH}" >> "$GITHUB_PATH"
+          "${DEST}/linux-${ARCH}/helm" version
 
       - name: Decodificar kubeconfig del tenant
         env: