Merge pull request #2687 from pikasTech/fix/gitea-cleanup-presync-prepare

修复 Gitea 清理 hook 的资源阶段顺序

config/platform-infra/gitea.yaml

@@ -703,6 +703,7 @@ app:
         upstream: http://gitea-http.devops-infra.svc.cluster.local:3000
     legacyCleanup:
       enabled: true
+      execute: false
       jobName: gitea-legacy-public-exposure-cleanup
       serviceAccountName: gitea-legacy-public-exposure-cleanup
       image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1

scripts/src/platform-infra-gitea-config.ts

@@ -42,6 +42,7 @@ export interface GiteaPublicExposure {
   }>;
   legacyCleanup: {
     enabled: boolean;
+    execute: boolean;
     jobName: string;
     serviceAccountName: string;
     image: string;
@@ -654,6 +655,7 @@ function parsePublicExposure(record: Record<string, unknown>, path: string): Git
     routes,
     legacyCleanup: {
       enabled: y.booleanField(legacyCleanup, "enabled", `${path}.legacyCleanup`),
+      execute: y.booleanField(legacyCleanup, "execute", `${path}.legacyCleanup`),
       jobName: y.kubernetesNameField(legacyCleanup, "jobName", `${path}.legacyCleanup`),
       serviceAccountName: y.kubernetesNameField(legacyCleanup, "serviceAccountName", `${path}.legacyCleanup`),
       image: y.stringField(legacyCleanup, "image", `${path}.legacyCleanup`),

scripts/src/platform-infra-gitea-gitops-delivery.test.ts

@@ -83,11 +83,10 @@ test("owning YAML renders one child Application and the complete durable bridge
     value: "https://gitea.hwpod.com/",
   });
   expect(resource("Deployment", "gitea-github-sync")).toBeDefined();
-  const cleanupJob = resource("Job", "gitea-legacy-public-exposure-cleanup");
-  expect(cleanupJob).toBeDefined();
-  expect(cleanupJob.metadata.annotations["argocd.argoproj.io/hook"]).toBe("PreSync");
-  expect(cleanupJob.spec.template.spec.containers[0].args).toContain("deployment/gitea-frpc");
-  expect(cleanupJob.spec.template.spec.containers[0].args).toContain("secret/gitea-frpc-secrets");
+  expect(resource("ServiceAccount", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
+  expect(resource("Role", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
+  expect(resource("RoleBinding", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
+  expect(resource("Job", "gitea-legacy-public-exposure-cleanup")).toBeUndefined();
   const pacReadOnlyNamespaces = documents
     .filter((item) => item.kind === "Role" && item.metadata?.name === "unidesk-pac-consumer-runner")
     .map((item) => item.metadata.namespace)

scripts/src/platform-infra-gitea.ts

@@ -1149,7 +1149,7 @@ function renderLegacyPublicExposureCleanupManifest(gitea: GiteaConfig, target: G
 app.kubernetes.io/component: legacy-public-exposure-cleanup
 app.kubernetes.io/part-of: devops-infra
 app.kubernetes.io/managed-by: unidesk`;
-  return `apiVersion: v1
+  const rbac = `apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ${cleanup.serviceAccountName}
@@ -1189,6 +1189,9 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: ${cleanup.serviceAccountName}
+`;
+  if (!cleanup.execute) return rbac;
+  return `${rbac.trim()}
 ---
 apiVersion: batch/v1
 kind: Job