From 5e46a24e7d43b62350960aa802235c8f00f8c07c Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 31 Jul 2026 12:00:00 +0000
Subject: [PATCH] ci: Verifikations-Job nach GitLab portiert, Gitea-Workflows
 entfernt (CFGMON-11)

Der deploy-on-push-Check (YAML-Manifest-Pruefung, SOPS-ENC-Kontrolle) laeuft
jetzt als leichter Job in der Lab-GitLab-CI; milestone-release.yml war seit
jeher toter Code (kein Runner, Releases wurden manuell per API erstellt,
siehe Issue #33). Flux bleibt unberuehrt - es zieht weiterhin vom
Gitea-Mirror. Damit verliert der Gitea-Runner builder-1 seinen letzten
aktiven Konsumenten.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/deploy-on-push.yml    | 50 --------------------------
 .gitea/workflows/milestone-release.yml | 32 -----------------
 .gitlab-ci.yml                         | 26 ++++++++++++++
 3 files changed, 26 insertions(+), 82 deletions(-)
 delete mode 100644 .gitea/workflows/deploy-on-push.yml
 delete mode 100644 .gitea/workflows/milestone-release.yml
 create mode 100644 .gitlab-ci.yml

diff --git a/.gitea/workflows/deploy-on-push.yml b/.gitea/workflows/deploy-on-push.yml
deleted file mode 100644
index 7032ae3..0000000
--- a/.gitea/workflows/deploy-on-push.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-name: Auto-Deploy on Push
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'apps/**'
-      - 'clusters/**'
-      - '.gitea/workflows/**'
-
-jobs:
-  verify-and-notify:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      
-      - name: Check YAML Syntax
-        run: |
-          echo "🔍 Validating YAML files..."
-          find apps clusters -name "*.yaml" -type f | while read file; do
-            if ! grep -q "^apiVersion:" "$file"; then
-              echo "⚠️ Warning: $file may not be a valid K8s manifest"
-            fi
-          done
-          echo "✅ YAML validation passed"
-      
-      - name: Check for SOPS Encryption
-        run: |
-          echo "🔐 Checking SOPS status..."
-          for file in $(git diff --name-only origin/main...HEAD -- '**/secret*.yaml' '**/credentials*.yaml'); do
-            if grep -q "ENC\[" "$file"; then
-              echo "✅ $file is encrypted"
-            else
-              echo "⚠️ WARNING: $file may not be encrypted!"
-            fi
-          done
-      
-      - name: Create Deployment Notification
-        run: |
-          echo "📤 Flux will reconcile changes within 1 minute"
-          echo "🔗 Monitor in Gitea: Projects → Releases (check tags)"
-          
-      - name: List Changed Files
-        run: |
-          echo "📋 Files changed in this push:"
-          git diff --name-only origin/main...HEAD
-
diff --git a/.gitea/workflows/milestone-release.yml b/.gitea/workflows/milestone-release.yml
deleted file mode 100644
index ee096c7..0000000
--- a/.gitea/workflows/milestone-release.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Create Release on Milestone Tag
-
-on:
-  push:
-    tags:
-      - 'm*-*-complete'
-
-jobs:
-  create-release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      
-      - name: Extract Milestone Info
-        id: milestone
-        run: |
-          TAG="${GITHUB_REF#refs/tags/}"
-          TITLE=$(git tag -l "$TAG" -n1 | awk '{print substr($0, index($0, $2))}')
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-          echo "title=$TITLE" >> $GITHUB_OUTPUT
-          echo "🏷️ Milestone: $TAG"
-          echo "📝 Title: $TITLE"
-      
-      - name: Create Release
-        run: |
-          echo "📦 Creating release for milestone: ${{ steps.milestone.outputs.tag }}"
-          echo "${{ steps.milestone.outputs.title }}" > /tmp/release-notes.txt
-          echo "Created: $(date)" >> /tmp/release-notes.txt
-          cat /tmp/release-notes.txt
-
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..416356f
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,26 @@
+# Leichter Verifikations-Job, portiert aus .gitea/workflows/deploy-on-push.yml
+# (Gitea-CI-Rueckbau, siehe Backlogs CFGMON-11). Deployt nichts - Flux reconciled
+# weiterhin selbststaendig aus dem Gitea-Mirror. Repo-Topologie: git.lab ist
+# kanonisch, rohana/Gitea ist Push-Mirror und Flux-Quelle.
+
+verify:
+  image: alpine:3.20
+  rules:
+    - if: $CI_COMMIT_BRANCH == "main"
+      changes:
+        - apps/**/*
+        - clusters/**/*
+        - .gitlab-ci.yml
+  script:
+    - apk add --no-cache git >/dev/null
+    - |
+      echo "YAML-Manifest-Check..."
+      find apps clusters -name "*.yaml" -type f | while read f; do
+        grep -q "^apiVersion:" "$f" || echo "WARN: $f enthaelt kein apiVersion - evtl. kein K8s-Manifest"
+      done
+    - |
+      echo "SOPS-Check der in diesem Push geaenderten Secret-Dateien..."
+      for f in $(git diff --name-only HEAD~1..HEAD -- '**/secret*.yaml' '**/credentials*.yaml' 2>/dev/null || true); do
+        if grep -q "ENC\[" "$f"; then echo "OK: $f ist verschluesselt"; else echo "WARNUNG: $f ist moeglicherweise NICHT verschluesselt!"; fi
+      done
+    - echo "Flux reconciled die Aenderungen innerhalb ~1 Minute (Quelle Gitea-Mirror)."