[hahn-kev]

fixes CI which is currently broken

---

AI summary

Summary

The deploy job ran kubectl set image on a self-hosted runner labelled languageforge that no longer exists. Every staging deploy since May has queued on it until GitHub cancelled the job after 24 hours. This replaces it with the LexBox pattern: commit new image tags to the fleet repo and let Rancher Fleet roll the cluster.

 integrate-and-deploy.yml
   inputs: image-tag-app, image-tag-proxy, image-tag-next-app
+          k8s-environment (staging | production), deploy-domain
-  secrets: kube-context
+  secrets: fleet-repo-ssh-key
   integrate
+    outputs.TAG_LFMERGE            # so deploy can pin lfmerge too
   deploy
-    runs-on: [self-hosted, languageforge]
-    kubectl set image deployment/{app,next-proxy,next-app,lfmerge}
+    runs-on: ubuntu-latest, concurrency per environment, GitHub environment + url
+    checkout ${{ vars.FLEET_REPO }}@main with FLEET_REPO_SSH_KEY   -> fleet/
+    yq: set newTag for the 4 images in fleet/languageforge/<env>/kustomize/kustomization.yaml
+    add-and-commit + push: "[Language Forge] Update <env> images to <tag>"
 staging.yml      + k8s-environment: staging,    deploy-domain: staging.languageforge.org
 production.yml   + k8s-environment: production, deploy-domain: languageforge.org
 docs/RELEASE.md    describes the fleet flow and manual deploy (edit the kustomization, push main)

Unlike LexBox, the fleet repo already holds the full Language Forge manifests under languageforge/<env>/kustomize/, so nothing is copied from this repo; only the four newTag values change. The docker/deployment folder here is now unused by CI.

Actions are SHA-pinned to the same versions LexBox uses. docker/login-action moved from v2 to v3 because actionlint rejects v2 as too old to run.

Evidence

• Before: staging run 39717933967 (merge of Rebuild base-php from the PHP 7.4 backport for CVE-2026-109618/109619 #1856): integrate and all e2e shards green, deploy queued forever. Run 25669681222 from May: deploy cancelled after exactly 24 h.
  After: actionlint -shellcheck= -pyflakes= .github/workflows/*.yml exits 0. The yq expression was run against a copy of the real staging kustomization and updated all four newTag values with the rest of the file byte-identical.

Not tested: an actual workflow run. It cannot run until the repository variable and secret below exist.

Merge Danger

Door: two-way

Revert the workflow; nothing in the cluster changes until a deploy runs.

Blast Radius: deploys only

Needs, before the first run on develop:

• Repository variable FLEET_REPO = sillsdev/languagedepot-deploy (same as LexBox).
• Repository secret FLEET_REPO_SSH_KEY = a deploy key with write access on that repo (LexBox's can be reused or a new one added).
• Environments staging and production are created automatically on first use; add required reviewers on production if you want an approval gate like LexBox.

staging.yml calls the reusable workflow @develop, so the new deploy job is live for staging as soon as this merges to develop. Production picks it up once master has it.

Test plan

• Add FLEET_REPO variable and FLEET_REPO_SSH_KEY secret
• Merge to develop; confirm the deploy job pushes a commit to languagedepot-deploy and Fleet updates staging.languageforge.org
• Check staging.languageforge.org serves PHP 7.4.34-dev (php -v in the app pod)

🤖 Generated with Claude Code

[github-actions]

Unit Test Results

362 tests   362 ✅  7s ⏱️
 37 suites    0 💤
  1 files      0 ❌

Results for commit bd7a234.