From 8099f7612cc8641c5b52c96bed35b3a47589487b Mon Sep 17 00:00:00 2001
From: pikastech <liang6516@outlook.com>
Date: Mon, 20 Jul 2026 18:22:22 +0200
Subject: [PATCH] fix: prepare Gitea legacy cleanup before hook

---
 config/platform-infra/gitea.yaml                         | 1 +
 scripts/src/platform-infra-gitea-config.ts               | 2 ++
 scripts/src/platform-infra-gitea-gitops-delivery.test.ts | 9 ++++-----
 scripts/src/platform-infra-gitea.ts                      | 5 ++++-
 4 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml
index 7c09dee9..bbe1fcf4 100644
--- a/config/platform-infra/gitea.yaml
+++ b/config/platform-infra/gitea.yaml
@@ -703,6 +703,7 @@ app:
         upstream: http://gitea-http.devops-infra.svc.cluster.local:3000
     legacyCleanup:
       enabled: true
+      execute: false
       jobName: gitea-legacy-public-exposure-cleanup
       serviceAccountName: gitea-legacy-public-exposure-cleanup
       image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
diff --git a/scripts/src/platform-infra-gitea-config.ts b/scripts/src/platform-infra-gitea-config.ts
index be561ec6..a01f4b80 100644
--- a/scripts/src/platform-infra-gitea-config.ts
+++ b/scripts/src/platform-infra-gitea-config.ts
@@ -42,6 +42,7 @@ export interface GiteaPublicExposure {
   }>;
   legacyCleanup: {
     enabled: boolean;
+    execute: boolean;
     jobName: string;
     serviceAccountName: string;
     image: string;
@@ -654,6 +655,7 @@ function parsePublicExposure(record: Record<string, unknown>, path: string): Git
     routes,
     legacyCleanup: {
       enabled: y.booleanField(legacyCleanup, "enabled", `${path}.legacyCleanup`),
+      execute: y.booleanField(legacyCleanup, "execute", `${path}.legacyCleanup`),
       jobName: y.kubernetesNameField(legacyCleanup, "jobName", `${path}.legacyCleanup`),
       serviceAccountName: y.kubernetesNameField(legacyCleanup, "serviceAccountName", `${path}.legacyCleanup`),
       image: y.stringField(legacyCleanup, "image", `${path}.legacyCleanup`),
diff --git a/scripts/src/platform-infra-gitea-gitops-delivery.test.ts b/scripts/src/platform-infra-gitea-gitops-delivery.test.ts
index cf3c5248..b3f03155 100644
--- a/scripts/src/platform-infra-gitea-gitops-delivery.test.ts
+++ b/scripts/src/platform-infra-gitea-gitops-delivery.test.ts
@@ -83,11 +83,10 @@ test("owning YAML renders one child Application and the complete durable bridge
     value: "https://gitea.hwpod.com/",
   });
   expect(resource("Deployment", "gitea-github-sync")).toBeDefined();
-  const cleanupJob = resource("Job", "gitea-legacy-public-exposure-cleanup");
-  expect(cleanupJob).toBeDefined();
-  expect(cleanupJob.metadata.annotations["argocd.argoproj.io/hook"]).toBe("PreSync");
-  expect(cleanupJob.spec.template.spec.containers[0].args).toContain("deployment/gitea-frpc");
-  expect(cleanupJob.spec.template.spec.containers[0].args).toContain("secret/gitea-frpc-secrets");
+  expect(resource("ServiceAccount", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
+  expect(resource("Role", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
+  expect(resource("RoleBinding", "gitea-legacy-public-exposure-cleanup")).toBeDefined();
+  expect(resource("Job", "gitea-legacy-public-exposure-cleanup")).toBeUndefined();
   const pacReadOnlyNamespaces = documents
     .filter((item) => item.kind === "Role" && item.metadata?.name === "unidesk-pac-consumer-runner")
     .map((item) => item.metadata.namespace)
diff --git a/scripts/src/platform-infra-gitea.ts b/scripts/src/platform-infra-gitea.ts
index f6666e07..66b3dafe 100644
--- a/scripts/src/platform-infra-gitea.ts
+++ b/scripts/src/platform-infra-gitea.ts
@@ -1149,7 +1149,7 @@ function renderLegacyPublicExposureCleanupManifest(gitea: GiteaConfig, target: G
 app.kubernetes.io/component: legacy-public-exposure-cleanup
 app.kubernetes.io/part-of: devops-infra
 app.kubernetes.io/managed-by: unidesk`;
-  return `apiVersion: v1
+  const rbac = `apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: ${cleanup.serviceAccountName}
@@ -1189,6 +1189,9 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: ${cleanup.serviceAccountName}
+`;
+  if (!cleanup.execute) return rbac;
+  return `${rbac.trim()}
 ---
 apiVersion: batch/v1
 kind: Job