fix(flux): pin app releases to immutable digests

apps/nxtgauge-admin-solid/overlays/prod/kustomization.yaml

@@ -3,8 +3,5 @@ namespace: nxtgauge
 kind: Kustomization
 resources:
   - ../../base
-patchesStrategicMerge:
-  - replicas-patch.yaml
-images:
-  - name: registry.nxtgauge.com/nxtgauge-admin-solid
-    newTag: latest
+patches:
+  - path: release-patch.yaml

apps/nxtgauge-admin-solid/overlays/prod/release-patch.yaml

@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: nxtgauge
+  name: nxtgauge-admin-solid
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: admin-solid
+          image: registry.nxtgauge.com/nxtgauge-admin-solid@sha256:1f534ad2029f741242436dd03b8f38e504b18b0fa8acf6ba0766ce6c70c2adb9

apps/nxtgauge-admin-solid/overlays/prod/replicas-patch.yaml

@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nxtgauge-admin-solid
-  namespace: nxtgauge
-spec:
-  replicas: 1

apps/nxtgauge-ai-assistant/overlays/prod/kustomization.yaml

@@ -1,8 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
 namespace: nxtgauge-ai
+kind: Kustomization
 resources:
   - ../../base
-images:
-  - name: registry.nxtgauge.com/nxtgauge-ai-assistant
-    newTag: latest
+patches:
+  - path: release-patch.yaml

apps/nxtgauge-ai-assistant/overlays/prod/release-patch.yaml

@@ -0,0 +1,11 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nxtgauge-ai-assistant
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: ai-assistant
+          image: registry.nxtgauge.com/nxtgauge-ai-assistant@sha256:17956c88918830564f1c6a93083a11183a3bec655b151a382568fd7a02e15b83

apps/nxtgauge-frontend-solid/overlays/prod/kustomization.yaml

@@ -3,8 +3,5 @@ namespace: nxtgauge
 kind: Kustomization
 resources:
   - ../../base
-patchesStrategicMerge:
-  - replicas-patch.yaml
-images:
-  - name: registry.nxtgauge.com/nxtgauge-frontend-solid
-    newTag: latest
+patches:
+  - path: release-patch.yaml

apps/nxtgauge-frontend-solid/overlays/prod/release-patch.yaml

@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: nxtgauge
+  name: nxtgauge-frontend-solid
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: frontend-solid
+          image: registry.nxtgauge.com/nxtgauge-frontend-solid@sha256:e376a501f918f21ce8c16358674e2600644dd7166913e39edc3f0d8d4d435090

apps/nxtgauge-frontend-solid/overlays/prod/replicas-patch.yaml

@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nxtgauge-frontend-solid
-  namespace: nxtgauge
-spec:
-  replicas: 1

scripts/set-app-release.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -lt 2 ] || [ "$#" -gt 3 ]; then
+  echo "usage: $0 <app> <image-ref> [replicas]" >&2
+  exit 1
+fi
+
+app="$1"
+image_ref="$2"
+replicas="${3:-1}"
+
+case "$app" in
+  admin-solid)
+    overlay="apps/nxtgauge-admin-solid/overlays/prod"
+    namespace="nxtgauge"
+    deployment="nxtgauge-admin-solid"
+    container="admin-solid"
+    ;;
+  frontend-solid)
+    overlay="apps/nxtgauge-frontend-solid/overlays/prod"
+    namespace="nxtgauge"
+    deployment="nxtgauge-frontend-solid"
+    container="frontend-solid"
+    ;;
+  ai-assistant)
+    overlay="apps/nxtgauge-ai-assistant/overlays/prod"
+    namespace=""
+    deployment="nxtgauge-ai-assistant"
+    container="ai-assistant"
+    ;;
+  *)
+    echo "unknown app: $app" >&2
+    exit 1
+    ;;
+esac
+
+{
+  echo 'apiVersion: apps/v1'
+  echo 'kind: Deployment'
+  echo 'metadata:'
+  if [ -n "$namespace" ]; then
+    echo "  namespace: $namespace"
+  fi
+  echo "  name: $deployment"
+  echo 'spec:'
+  echo "  replicas: $replicas"
+  echo '  template:'
+  echo '    spec:'
+  echo '      containers:'
+  echo "        - name: $container"
+  echo "          image: $image_ref"
+} > "$overlay/release-patch.yaml"