From e17bcb25c64edad0ac9fca965e9b1e6545613f2b Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 14 Oct 2026 21:02:28 +0200
Subject: [PATCH] Render tag-only image references and test them in CI

---
 .gitea/workflows/deploy.yml | 7 ++-----
 templates/deployment.yaml   | 2 +-
 test.sh                     | 4 ++++
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index e0b6a3e..9b9eafd 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -32,11 +32,8 @@ jobs:
 
       - name: Lint and render
         run: |
-          "${RUNNER_TEMP}/helm" lint . --values values-brunner-ninja.yaml
-          "${RUNNER_TEMP}/helm" template "${RELEASE_NAME}" . \
-            --namespace "${NAMESPACE}" \
-            --values values-brunner-ninja.yaml > "${RUNNER_TEMP}/rendered.yaml"
-          test -s "${RUNNER_TEMP}/rendered.yaml"
+          export PATH="${RUNNER_TEMP}:${PATH}"
+          ./test.sh
 
   deploy:
     name: Deploy to Kubernetes
diff --git a/templates/deployment.yaml b/templates/deployment.yaml
index bcb7e28..7149048 100644
--- a/templates/deployment.yaml
+++ b/templates/deployment.yaml
@@ -29,7 +29,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: nginx
-          image: {{ printf "%s:%s@%s" .Values.image.repository .Values.image.tag .Values.image.digest | quote }}
+          image: {{ printf "%s:%s" .Values.image.repository .Values.image.tag | quote }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http
diff --git a/test.sh b/test.sh
index a9ebcd6..2638486 100755
--- a/test.sh
+++ b/test.sh
@@ -23,6 +23,10 @@ for values_file in "${values_files[@]}"; do
     --namespace default \
     --values "${values_path}" > "${output}"
   test -s "${output}"
+  if grep -Eq 'image:.*(@|%!|<nil>)' "${output}"; then
+    echo "Rendered image must use a valid repository:tag reference" >&2
+    exit 1
+  fi
 done
 
 if [[ -f "${workdir}/values-brunner-ninja.yaml" ]]; then