From 50b1a744f98ab8c3b98fc6fec6db6a01c3549240 Mon Sep 17 00:00:00 2001
From: Kevin Hahn <kevin_hahn@sil.org>
Date: Thu, 22 Oct 2026 11:41:28 +0700
Subject: [PATCH] Use expanded image tags in the fleet deploy step

The image-tag-* inputs contain shell substitutions like $(date +%Y%m%d).
The old kubectl step ran in a shell and expanded them; the yq step passes
inputs verbatim, so the first fleet deploy wrote the literal
"develop-$(date +%Y%m%d)-<sha>" into the staging kustomization.

The integrate job already expands the inputs when it writes them to
$GITHUB_OUTPUT, so expose TAG_APP/TAG_PROXY/TAG_NEXT_APP as job outputs
and have deploy use those, matching the tags actually pushed to Docker Hub.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/integrate-and-deploy.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/integrate-and-deploy.yml b/.github/workflows/integrate-and-deploy.yml
index d1be0f54e5..780497c6b5 100644
--- a/.github/workflows/integrate-and-deploy.yml
+++ b/.github/workflows/integrate-and-deploy.yml
@@ -104,6 +104,9 @@ jobs:
         run: docker push --all-tags ${{ steps.image.outputs.NAMESPACE }}
 
     outputs:
+      TAG_APP: ${{ steps.image.outputs.TAG_APP }}
+      TAG_PROXY: ${{ steps.image.outputs.TAG_PROXY }}
+      TAG_NEXT_APP: ${{ steps.image.outputs.TAG_NEXT_APP }}
       TAG_LFMERGE: ${{ steps.image.outputs.TAG_LFMERGE }}
       IMAGE_APP: ${{ steps.image.outputs.NAMESPACE }}:${{ steps.image.outputs.TAG_APP }}
       IMAGE_PROXY: ${{ steps.image.outputs.NAMESPACE }}:${{ steps.image.outputs.TAG_PROXY }}
@@ -139,13 +142,17 @@ jobs:
           path: fleet
           ref: main
       -
+        # The image-tag-* inputs contain shell substitutions such as $(date +%Y%m%d).
+        # The integrate job expands them in a shell step and exposes the results as
+        # outputs; use those, never the raw inputs, or the literal "$(date ...)"
+        # ends up in the kustomization.
         name: Update image tags in fleet kustomization.yaml
         uses: mikefarah/yq@504fc38780cc46be8444ea1b72fb55919fc0bfb0 # v4.54.1
         env:
           KUSTOMIZATION: fleet/languageforge/${{ inputs.k8s-environment }}/kustomize/kustomization.yaml
-          TAG_APP: ${{ inputs.image-tag-app }}
-          TAG_PROXY: ${{ inputs.image-tag-proxy }}
-          TAG_NEXT_APP: ${{ inputs.image-tag-next-app }}
+          TAG_APP: ${{ needs.integrate.outputs.TAG_APP }}
+          TAG_PROXY: ${{ needs.integrate.outputs.TAG_PROXY }}
+          TAG_NEXT_APP: ${{ needs.integrate.outputs.TAG_NEXT_APP }}
           TAG_LFMERGE: ${{ needs.integrate.outputs.TAG_LFMERGE }}
         with:
           cmd: |
@@ -163,7 +170,7 @@ jobs:
         uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # v11.1.1
         with:
           default_author: github_actions
-          message: "[Language Forge] Update ${{ inputs.k8s-environment }} images to ${{ inputs.image-tag-app }}"
+          message: "[Language Forge] Update ${{ inputs.k8s-environment }} images to ${{ needs.integrate.outputs.TAG_APP }}"
           cwd: "./fleet/"
           add: "languageforge/${{ inputs.k8s-environment }}/*"
           push: true