From 848aae6450312582e7b2940ee5675c586421c22c Mon Sep 17 00:00:00 2001
From: iilc <ilopez@coralware.cloud>
Date: Sat, 16 May 2026 17:32:58 -0500
Subject: [PATCH] =?UTF-8?q?fix(ci):=20helm-deploy=20sin=20container:=20?=
 =?UTF-8?q?=E2=80=94=20incompatible=20con=20runners=20executor=3Dhost=20[s?=
 =?UTF-8?q?kip=20ci]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

El job helm-deploy declaraba container: alpine/helm:3.14.4. Los runners de
ci-system corren con container.enabled=false (executor=host, ADR-043): sin
Docker daemon, cualquier job con container: falla al arrancar con 'Cannot
connect to the Docker daemon' antes de ejecutar step alguno (mismo patron
que SMOKE-COVE-WORKFLOW-CONTAINER-FIX).

Fix: se elimina container:; el job corre directo sobre el runner host.
kubectl ya viene en la imagen del runner; helm se instala en runtime via
curl (la NetworkPolicy de los runners permite egress 443). kubeconfig al
HOME del runner en vez de /root.

GOLDEN-PATH-WEBBACKEND-DRYRUN.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .gitea/workflows/APP_NAME-build.yaml | 30 +++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/APP_NAME-build.yaml b/.gitea/workflows/APP_NAME-build.yaml
index 41d64df..46761ed 100644
--- a/.gitea/workflows/APP_NAME-build.yaml
+++ b/.gitea/workflows/APP_NAME-build.yaml
@@ -21,15 +21,31 @@ jobs:
       enforce_rollback: false         # rollout lo gestiona el job helm-deploy abajo
 
   # Deploy al cluster del tenant — Helm upgrade --install con hook Alembic.
+  # El runner corre executor=host (ci-system: container.enabled=false, ADR-043):
+  # los steps se ejecutan directo sobre el pod runner, sin Docker daemon. Por eso
+  # NO se usa `container:` — kubectl ya viene en la imagen del runner; helm se
+  # instala en runtime (la NetworkPolicy de los runners permite egress 443).
   helm-deploy:
     needs: build
-    runs-on: [self-hosted, linux/amd64]
-    container: alpine/helm:3.14.4
+    runs-on: [self-hosted, buildkit]
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install kubectl
-        run: apk add --no-cache kubectl
+      - name: Instalar helm
+        run: |
+          HELM_VERSION=v3.14.4
+          case "$(uname -m)" in
+            x86_64)  ARCH=amd64 ;;
+            aarch64) ARCH=arm64 ;;
+            *) echo "Arquitectura no soportada: $(uname -m)"; exit 1 ;;
+          esac
+          mkdir -p "${HOME}/.local/bin"
+          curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz" \
+            | tar -xz -C /tmp "linux-${ARCH}/helm"
+          mv "/tmp/linux-${ARCH}/helm" "${HOME}/.local/bin/helm"
+          chmod +x "${HOME}/.local/bin/helm"
+          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
+          "${HOME}/.local/bin/helm" version
 
       - name: Decodificar kubeconfig del tenant
         env:
@@ -40,9 +56,9 @@ jobs:
             echo "tenant-manager debe provisionarlo al crear el repo."
             exit 1
           fi
-          mkdir -p /root/.kube
-          echo "$KUBECONFIG_B64" | base64 -d > /root/.kube/config
-          chmod 600 /root/.kube/config
+          mkdir -p "${HOME}/.kube"
+          echo "$KUBECONFIG_B64" | base64 -d > "${HOME}/.kube/config"
+          chmod 600 "${HOME}/.kube/config"
 
       - name: Helm upgrade --install
         env: