From 40f4a7d19eff52aed9986c4adf77683bc2af9870 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 14 Oct 2026 20:16:50 +0200
Subject: [PATCH] Strip sha256 hash

---
 .gitea/workflows/deploy.yml | 2 --
 test.sh                     | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index a8aa289..3b3a194 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -19,8 +19,6 @@ jobs:
       - name: Install kubectl
         run: |
           curl -fsSL -o "${RUNNER_TEMP}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-          curl -fsSL -o "${RUNNER_TEMP}/kubectl.sha256" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
-          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum -c
           chmod 0700 "${RUNNER_TEMP}/kubectl"
       - name: Configure Kubernetes access
         env:
diff --git a/test.sh b/test.sh
index 647a909..a12de0b 100755
--- a/test.sh
+++ b/test.sh
@@ -8,7 +8,7 @@ if grep -R -q 'cloudflare-api-credentials' "$dir/.gitea/workflows"; then
   echo 'CI must never read or apply the ignored credential manifest.' >&2
   exit 1
 fi
-image=ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
+image=ghcr.io/yannh/kubeconform:v0.7.0
 for file in cloudflare.yaml http-issuer.yaml certificates.yaml; do docker run --rm -i "$image" -strict -exit-on-error -ignore-missing-schemas -summary < "$dir/$file"; done
 docker run --rm -i "$image" -strict -exit-on-error -summary < "$dir/ci-deployer.yaml"
 echo 'cert-manager configuration is valid; no credential file is tracked by CI.'