fix(flux): pin backend rust releases to digests

.github/workflows/trigger-app-builds-from-gitops.yml

@@ -1,83 +0,0 @@
-name: Trigger App Builds From GitOps
-
-on:
-  push:
-    branches:
-      - main
-      - testingcodex
-    paths:
-      - apps/nxtgauge-backend/**
-      - apps/nxtgauge-admin-frontend/**
-      - apps/nxtgauge-frontendwebsite/**
-
-permissions:
-  contents: read
-
-jobs:
-  detect-changes:
-    if: ${{ github.actor != 'github-actions[bot]' && !startsWith(github.event.head_commit.message, 'chore(gitops): update ') }}
-    runs-on: ubuntu-latest
-    outputs:
-      backend: ${{ steps.filter.outputs.backend }}
-      admin: ${{ steps.filter.outputs.admin }}
-      public: ${{ steps.filter.outputs.public }}
-    steps:
-      - name: Checkout GitOps repo
-        uses: actions/checkout@v4
-
-      - name: Detect changed app paths
-        id: filter
-        uses: dorny/paths-filter@v3
-        with:
-          filters: |
-            backend:
-              - 'apps/nxtgauge-backend/**'
-            admin:
-              - 'apps/nxtgauge-admin-frontend/**'
-            public:
-              - 'apps/nxtgauge-frontendwebsite/**'
-
-  trigger-backend:
-    needs: detect-changes
-    if: ${{ needs.detect-changes.outputs.backend == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger backend workflow
-        env:
-          TOKEN: ${{ secrets.GITOPS_PAT }}
-        run: |
-          curl -sS -X POST \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${TOKEN}" \
-            https://api.github.com/repos/Traceworks2023/nxtgauge-nov-2025-backend/actions/workflows/build-and-push-ghcr.yml/dispatches \
-            -d '{"ref":"testingcodex"}'
-
-  trigger-admin-frontend:
-    needs: detect-changes
-    if: ${{ needs.detect-changes.outputs.admin == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger admin frontend workflow
-        env:
-          TOKEN: ${{ secrets.GITOPS_PAT }}
-        run: |
-          curl -sS -X POST \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${TOKEN}" \
-            https://api.github.com/repos/Traceworks2023/nxtgauge-nov-2025-frontend/actions/workflows/build-push-and-update-gitops.yml/dispatches \
-            -d '{"ref":"testingcodex"}'
-
-  trigger-public-frontend:
-    needs: detect-changes
-    if: ${{ needs.detect-changes.outputs.public == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger public frontend workflow
-        env:
-          TOKEN: ${{ secrets.GITOPS_PAT }}
-        run: |
-          curl -sS -X POST \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${TOKEN}" \
-            https://api.github.com/repos/Traceworks2023/nxtgauge-frontendwebsite/actions/workflows/build-push-and-update-gitops.yml/dispatches \
-            -d '{"ref":"testingcodex"}'

apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv

@@ -0,0 +1,20 @@
+gateway	sha256:a7874b3460d30bb3b1c6dbd7be736bdc065d12104c8a93e61a8690215b59bcd5	2
+users	sha256:6fc04865833b8926477fb579b9e0bec0bf6088f8f98b7f372fddbec245ef56e5	1
+companies	-	0
+jobs	-	0
+leads	-	0
+job-seekers	-	0
+customers	sha256:38b0263a6727499b5d590ca9f1b74b6eaccb41b4948b7eb00ebb57a4a718f2d1	1
+payments	-	0
+employees	sha256:b27cfe094ec3b597af92327652f1ef0b175594792ac73e2b0a42a1e590685c1d	1
+photographers	-	0
+makeup-artists	-	0
+tutors	-	0
+developers	sha256:5c7132597203c922a97be39c83f129ef6a2fbfb34971fe4f2d34472c3a6ae22e	1
+video-editors	-	0
+graphic-designers	sha256:79b06fd6ea6c7b40efb2e807310d48f006c97989233778ce81a38498a56a8339	1
+social-media-managers	-	0
+fitness-trainers	sha256:03321ccfd266ce1aa4d9380abaef28cef89c9af5b1ea0d3ea2a3adad77c94db9	1
+catering-services	sha256:00c0422ae68717566a97d8e6c192f1d0a0f8cb45f38f544d5d3db5853915bb86	1
+ugc-content-creators	-	0
+cron	sha256:11ae3e7619273b3746670250a2403ac4b64cd3ed6eaca0c1e2db4b0c34fd0808	1

apps/nxtgauge-backend-rust/overlays/prod/disabled-deployments.yaml

@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-companies
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-jobs
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-leads
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-job-seekers
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-payments
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-photographers
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-makeup-artists
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-tutors
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-video-editors
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-social-media-managers
+spec:
+  replicas: 0
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-ugc-content-creators
+spec:
+  replicas: 0

apps/nxtgauge-backend-rust/overlays/prod/kustomization.yaml

@@ -4,48 +4,5 @@ kind: Kustomization
 resources:
   - ../../base
 patches:
-  - path: replicas-patch.yaml
+  - path: release-patches.yaml
-    target:
+  - path: disabled-deployments.yaml
-      kind: Deployment
-      name: nxtgauge-rust-gateway
-images:
-  - name: registry.nxtgauge.com/nxtgauge-rust-catering-services
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-companies
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-cron
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-customers
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-developers
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-employees
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-fitness-trainers
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-gateway
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-graphic-designers
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-jobs
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-job-seekers
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-leads
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-makeup-artists
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-payments
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-photographers
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-social-media-managers
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-tutors
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-ugc-content-creators
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-users
-    newTag: latest
-  - name: registry.nxtgauge.com/nxtgauge-rust-video-editors
-    newTag: latest

apps/nxtgauge-backend-rust/overlays/prod/release-patches.yaml

@@ -0,0 +1,107 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-gateway
+spec:
+  replicas: 2
+  template:
+    spec:
+      containers:
+        - name: gateway
+          image: registry.nxtgauge.com/nxtgauge-rust-gateway@sha256:a7874b3460d30bb3b1c6dbd7be736bdc065d12104c8a93e61a8690215b59bcd5
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-users
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: users
+          image: registry.nxtgauge.com/nxtgauge-rust-users@sha256:6fc04865833b8926477fb579b9e0bec0bf6088f8f98b7f372fddbec245ef56e5
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-customers
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: customers
+          image: registry.nxtgauge.com/nxtgauge-rust-customers@sha256:38b0263a6727499b5d590ca9f1b74b6eaccb41b4948b7eb00ebb57a4a718f2d1
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-employees
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: employees
+          image: registry.nxtgauge.com/nxtgauge-rust-employees@sha256:b27cfe094ec3b597af92327652f1ef0b175594792ac73e2b0a42a1e590685c1d
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-developers
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: developers
+          image: registry.nxtgauge.com/nxtgauge-rust-developers@sha256:5c7132597203c922a97be39c83f129ef6a2fbfb34971fe4f2d34472c3a6ae22e
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-graphic-designers
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: graphic-designers
+          image: registry.nxtgauge.com/nxtgauge-rust-graphic-designers@sha256:79b06fd6ea6c7b40efb2e807310d48f006c97989233778ce81a38498a56a8339
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-fitness-trainers
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: fitness-trainers
+          image: registry.nxtgauge.com/nxtgauge-rust-fitness-trainers@sha256:03321ccfd266ce1aa4d9380abaef28cef89c9af5b1ea0d3ea2a3adad77c94db9
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-catering-services
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: catering-services
+          image: registry.nxtgauge.com/nxtgauge-rust-catering-services@sha256:00c0422ae68717566a97d8e6c192f1d0a0f8cb45f38f544d5d3db5853915bb86
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-rust-cron
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: cron
+          image: registry.nxtgauge.com/nxtgauge-rust-cron@sha256:11ae3e7619273b3746670250a2403ac4b64cd3ed6eaca0c1e2db4b0c34fd0808

apps/nxtgauge-backend-rust/overlays/prod/replicas-patch.yaml

@@ -1,6 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nxtgauge-rust-gateway
-spec:
-  replicas: 2

scripts/render-backend-rust-release-state.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+state_file="$repo_root/apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv"
+release_file="$repo_root/apps/nxtgauge-backend-rust/overlays/prod/release-patches.yaml"
+disabled_file="$repo_root/apps/nxtgauge-backend-rust/overlays/prod/disabled-deployments.yaml"
+
+: > "$release_file"
+: > "$disabled_file"
+release_first=true
+disabled_first=true
+
+while IFS=$'\t' read -r service digest replicas; do
+  [ -n "$service" ] || continue
+  deployment="nxtgauge-rust-$service"
+  container="$service"
+
+  if [ "$digest" != "-" ]; then
+    if [ "$release_first" = false ]; then
+      printf '%s\n' '---' >> "$release_file"
+    fi
+    release_first=false
+    cat >> "$release_file" <<PATCH
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: $deployment
+spec:
+  replicas: $replicas
+  template:
+    spec:
+      containers:
+        - name: $container
+          image: registry.nxtgauge.com/nxtgauge-rust-$service@$digest
+PATCH
+  fi
+
+  if [ "$replicas" = "0" ]; then
+    if [ "$disabled_first" = false ]; then
+      printf '%s\n' '---' >> "$disabled_file"
+    fi
+    disabled_first=false
+    cat >> "$disabled_file" <<PATCH
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: $deployment
+spec:
+  replicas: 0
+PATCH
+  fi
+done < "$state_file"

scripts/set-backend-rust-release.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: $0 <service> <digest>" >&2
+  exit 1
+fi
+
+service="$1"
+digest="$2"
+
+case "$service" in
+  gateway) replicas=2 ;;
+  users|companies|jobs|leads|job-seekers|customers|payments|employees|photographers|makeup-artists|tutors|developers|video-editors|graphic-designers|social-media-managers|fitness-trainers|catering-services|ugc-content-creators|cron) replicas=1 ;;
+  *)
+    echo "unknown service: $service" >&2
+    exit 1
+    ;;
+esac
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+state_file="$repo_root/apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv"
+tmp_file="$state_file.tmp"
+
+awk -F '\t' -v OFS='\t' -v service="$service" -v digest="$digest" -v replicas="$replicas" '
+  $1 == service { $2 = digest; $3 = replicas }
+  { print }
+' "$state_file" > "$tmp_file"
+mv "$tmp_file" "$state_file"
+
+"$repo_root/scripts/render-backend-rust-release-state.sh"