feat(diagnose-flux): extract the duplicated Flux failure-diagnostics block into a shared composite action

[devantler]

🤖 Generated by the Daily AI Assistant

Problem

The 🩺 Diagnose Flux on failure step — a set +e dump of Flux Kustomizations/HelmReleases/OCIRepositories, controller logs, failing-pod logs and warning events used to debug a stuck reconcile in CI/CD — is copy-pasted across four jobs portfolio-wide, and the copies have already drifted:

Repo	File	Step location	Notes
devantler-tech/platform-template	.github/workflows/ci.yaml	system-test job, L99 (~77 lines)	richest copy — dumps logs from any non-Running / CrashLoopBackOff / ImagePullBackOff pod via containerStatuses inspection; --tail=300/300/200
devantler-tech/platform-template	.github/workflows/ci.yaml	deploy-prod job, L365 (~37 lines)	lacks the failing-pod log-dump logic; --tail=200/200/100
devantler-tech/platform-template	.github/workflows/cd.yaml	deploy-prod job, L273 (~35 lines)	same reduced variant
devantler-tech/platform	.github/actions/deploy-prod/action.yml	L290	portfolio-wide confirmation this is a shared pattern, not a one-off

Because the three platform-template copies are not byte-identical (the system-test copy is ~2× longer and carries CrashLoop/pod-log logic the two deploy-prod/cd.yaml copies do not), the prod-deploy failure paths currently emit strictly worse diagnostics than the system-test path — exactly when good diagnostics matter most (a failed real deploy). This is genuine within-repo + cross-repo duplication, not Template-Sync's by-design propagation.

The maintainer already flagged the adjacent extraction in-code (platform-template/.github/workflows/ci.yaml L307–312, re. the cosign signing block): "…ideally by extracting cd.yaml's block into a shared composite action so the two paths can never drift again." The same remedy applies to the diagnostics block.

Proposed direction

Add a devantler-tech/actions/diagnose-flux composite action built from the richest (system-test) variant — the union with the CrashLoop/failing-pod log-dump logic — so every consumer inherits the best diagnostics and the copies can never drift again:

• Inputs: kustomizations (space-separated names to describe on failure; default infrastructure-controllers infrastructure apps), optionally controller-log-tail / pod-log-tail for the --tail values.
• Behaviour: the existing set +e grouped dump (Kustomizations/HelmReleases/OCIRepositories status + describe, controller logs, all-pods, the containerStatuses-based failing-pod previous+current log dump, warning events).
• Then replace the three platform-template copies with a single pinned uses: step.

devantler-tech/actions has no diagnose-flux composite today (verified live: existing dirs are aggregate-job-checks, approve-pr, cleanup-ghcr-packages, create-issues-from-todos, dependency-review, enable-auto-merge-on-pr, free-disk-space, login-to-ghcr, run-dotnet-tests, setup-agent-skills, setup-go-toolchain, setup-ksail-cli, sync-github-labels, update-agent-skills, upload-coverage, upsert-issue).

Acceptance criteria

• A diagnose-flux composite action exists in devantler-tech/actions, documented in its README.md, lint-clean (actionlint), and covers the richest current behaviour.
• All three platform-template callsites (ci.yaml ×2, cd.yaml ×1) consume the pinned composite; no diagnostics behaviour is lost on any path.
• platform's deploy-prod action migrating to the composite is captured as a follow-up (that repo is maintainer-hot — separate PR, maintainer-sequenced).

Companion / scope note

The same lines (L307–312) note the cosign signing block in ci.yaml's deploy-prod is also a "faithful copy" of cd.yaml's, with SBOM (syft) + SLSA attestation intentionally not yet mirrored to the merge-queue path. That extraction is a natural companion but carries a maintainer decision (attestation-parity is a deliberate staged rollout) — track separately; this issue is scoped to the diagnostics block only.

Size

M — one new composite (~100 lines, mostly the existing bash) + 3 callsite swaps in platform-template; the platform callsite is a maintainer-sequenced follow-up. Shippable incrementally (composite + README first, then the platform-template migration).

[devantler]

🤖 Generated by the Daily AI Assistant

Progress — 3 of 4 callsites migrated. platform-template#46 merged (2026-06-27), replacing all three platform-template 🩺 Diagnose Flux on failure callsites with the shared composite devantler-tech/actions/diagnose-flux@v7.1.0:

• ci.yaml system-test job (behaviour-preserving — the composite was extracted byte-for-byte from this richest variant)
• ci.yaml deploy-prod job (strict diagnostics upgrade — gains Nodes/all-pods/failing-pod/Jobs dumps)
• cd.yaml deploy-prod job (same upgrade)

Net −124 lines; if: conditions preserved verbatim; the vestigial env: HCLOUD_TOKEN on the two prod steps was dropped (Talos-cert kubeconfig needs no Hetzner token).

Remaining: 1 callsite — devantler-tech/platform's deploy-prod action. Intentionally left out of #46 because platform is a maintainer-hot, live-prod repo with an active SSO/Cilium/Gateway-API campaign in flight; migrating its diagnostics callsite there warrants the maintainer's own sequencing. This issue stays open to track that last callsite. Recommend closing once platform's callsite adopts the composite (or repointing the issue to platform if the maintainer prefers to track it there).

[devantler]

🤖 Generated by the Daily AI Assistant

4 of 4 callsites migrated — final one up as a draft. platform#2317 replaces the last inline 🩺 Diagnose Flux on failure block — devantler-tech/platform .github/actions/deploy-prod/action.yml (the prod-deploy reconcile failure path) — with devantler-tech/actions/diagnose-flux@e182f22 # v7.1.0, the same SHA the platform-template callsites use.

Behaviour-preserving + a strict diagnostics upgrade: the composite's kustomizations input defaults to infrastructure-controllers infrastructure apps (identical to the list this callsite hard-coded), and the step is failure-path-only (if: failure()), so it cannot affect a green deploy — it only widens what prints when a deploy has already failed (gains Nodes / all-pods / failing-pod / Job-log / failing-Job dumps and larger --tails). All checks green; awaiting maintainer promotion → merge will Fixes this issue and close the consolidation epic.