ci: deploy via rollout restart instead of git-commit image bumps

Switch deployment to floating :main tag with imagePullPolicy: Always
and have CI trigger a rollout restart directly via kubectl. Removes
the [skip ci] image-bump commits from main's history.

Requires a KUBECONFIG_DATA secret (base64-encoded kubeconfig with
permission to restart deployment/aprs in the aprs namespace) in
Forgejo Actions.

.forgejo/workflows/build.yaml

@@ -45,20 +45,17 @@ jobs:
           docker push "${IMAGE}:${TAG}"
           docker push "${IMAGE}:main"
 
-      - name: Update deployment manifest
+      - name: Install kubectl
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ steps.tag.outputs.tag }}"
-          sed -i "s|image: ${IMAGE}:.*|image: ${IMAGE}:${TAG}|g" k8s/deployment.yaml
+          curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+          install -m 0755 kubectl /usr/local/bin/kubectl
 
-      - name: Commit and push updated manifest
+      - name: Trigger rollout (no git commit)
+        env:
+          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG_DATA }}
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ steps.tag.outputs.tag }}"
-          git config user.name "FluxCD"
-          git config user.email "fluxcd@w5isp.com"
-          git remote set-url origin https://x-token:${{ github.token }}@git.mcintire.me/graham/aprs.me.git
-          git add k8s/deployment.yaml
-          git diff --cached --quiet && echo "No changes to commit" && exit 0
-          git commit -m "chore: update aprs.me image to ${IMAGE}:${TAG} [skip ci]"
-          git push origin main
+          mkdir -p "$HOME/.kube"
+          printf '%s' "$KUBECONFIG_DATA" | base64 -d > "$HOME/.kube/config"
+          chmod 600 "$HOME/.kube/config"
+          kubectl -n aprs rollout restart deployment/aprs
+          kubectl -n aprs rollout status deployment/aprs --timeout=5m

k8s/deployment.yaml

@@ -31,8 +31,8 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: migrate
-          image: git.mcintire.me/graham/aprs.me:main-1777403979-3f2e025
-          imagePullPolicy: IfNotPresent
+          image: git.mcintire.me/graham/aprs.me:main
+          imagePullPolicy: Always
           command: ["/app/bin/migrate"]
           securityContext:
             allowPrivilegeEscalation: false
@@ -82,8 +82,8 @@ spec:
               cpu: "500m"
       containers:
         - name: aprs
-          image: git.mcintire.me/graham/aprs.me:main-1777403979-3f2e025
-          imagePullPolicy: IfNotPresent
+          image: git.mcintire.me/graham/aprs.me:main
+          imagePullPolicy: Always
           securityContext:
             allowPrivilegeEscalation: false
             runAsNonRoot: true