Rework Docker CI config

.woodpecker.yaml

@@ -5,14 +5,6 @@ when:
 
 steps:
   - name: build-and-push
-    # Pinned: WOODPECKER_PLUGINS_PRIVILEGED on the server must allow this exact
-    # image:tag, so a floating tag here would silently break the build.
-    #
-    # Deliberately NO `privileged: true` here -- that flag requires repo-level
-    # "security" trust and is rejected without it. The server-side allowlist
-    # escalates this step instead, but only while it stays a *plugin*: adding
-    # `commands`, `entrypoint`, or `environment` to this step silently drops
-    # the escalation and buildx's inner daemon will fail to start.
     image: woodpeckerci/plugin-docker-buildx:6.1.1
     settings:
       registry: registry.apps.millslan.net
@@ -24,3 +16,19 @@ steps:
         from_secret: registry_username
       password:
         from_secret: registry_password
+
+  - name: deploy
+    # kubectl minor must stay within +/-1 of the cluster (k0s v1.36.3).
+    image: alpine/k8s:1.36.1
+    environment:
+      KUBECONFIG_B64:
+        from_secret: kubeconfig_b64
+    commands:
+      - echo "$KUBECONFIG_B64" | base64 -d > "$CI_WORKSPACE/.kubeconfig"
+      - chmod 600 "$CI_WORKSPACE/.kubeconfig"
+      - export KUBECONFIG="$CI_WORKSPACE/.kubeconfig"
+      - kubectl apply -f deploy/
+      - kubectl -n coreid rollout restart deployment/coreid
+      - kubectl -n coreid rollout status deployment/coreid --timeout=5m
+    when:
+      - event: [tag, manual]