Fix integration and docs-preview-cleanup CI (#52)

* ci: reach gateway via port-forward, fix kind cleanup and preview-deletion listing

* ci: wait for the nebi deployment to exist before asserting on it

---------

Co-authored-by: Amit Kumar <aktech@users.noreply.github.com>

Author: aktech

.github/workflows/docs-preview-cleanup.yml

@@ -22,8 +22,12 @@ jobs:
         run: |
           set -euo pipefail
           base="https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/pages/projects/${CF_PROJECT}/deployments"
-          ids=$(curl -fsS -H "Authorization: Bearer ${CF_API_TOKEN}" "${base}?env=preview&per_page=100" \
-            | jq -r --arg b "$BRANCH" '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')
+          # No ?env=preview filter — the deployments list endpoint rejects it
+          # with HTTP 400; the branch filter below already excludes production
+          # deployments (those trigger from main).
+          ids=$(curl -fsS -H "Authorization: Bearer ${CF_API_TOKEN}" "${base}?per_page=100" \
+            | jq -r --arg b "$BRANCH" '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id') \
+            || { echo "::warning::Could not list preview deployments; skipping cleanup."; exit 0; }
           if [ -z "$ids" ]; then
             echo "No preview deployments found for branch '$BRANCH'."
             exit 0

.github/workflows/test.yaml

@@ -60,6 +60,17 @@ jobs:
 
       - name: Verify deployment and operator-wired OIDC
         run: |
+          # add-software-pack returns as soon as the Application reports
+          # Healthy, which a freshly created app does vacuously before its
+          # first sync creates any resources. Wait for the Deployment to
+          # exist before asserting anything about it (rollout status with a
+          # selector exits 0 on zero matches, so it is not a wait).
+          for i in $(seq 1 60); do
+            kubectl get deploy -n nebi -l app.kubernetes.io/name=nebari-nebi-pack \
+              -o name 2>/dev/null | grep -q . && break
+            echo "Waiting for nebi deployment to be created... (${i}/60)"
+            sleep 5
+          done
           kubectl rollout status deployment -n nebi \
             -l app.kubernetes.io/name=nebari-nebi-pack --timeout=180s
 
@@ -71,18 +82,26 @@ jobs:
             || { echo "OIDC env not wired"; exit 1; }
 
       - name: Verify the gateway redirects nebi to Keycloak
-        env:
-          GATEWAY_IP: ${{ steps.sandbox.outputs.gateway-ip }}
+        # Reach the gateway through a port-forward to Envoy's LoadBalancer
+        # Service rather than the LB IP, which is not routable from the
+        # runner's network namespace.
         run: |
+          svc=$(kubectl get svc -n envoy-gateway-system \
+            -o jsonpath='{.items[?(@.spec.type=="LoadBalancer")].metadata.name}')
+          kubectl port-forward -n envoy-gateway-system "svc/${svc}" 8443:443 &
+          pf=$!
+          trap 'kill $pf' EXIT
+          for i in $(seq 1 30); do
+            curl -sk -o /dev/null --connect-timeout 2 https://127.0.0.1:8443/ && break
+            sleep 1
+          done
           loc=$(curl -sk -o /dev/null -w '%{redirect_url}' \
-            --resolve "nebi.nebari.local:443:${GATEWAY_IP}" \
-            https://nebi.nebari.local/)
+            --resolve "nebi.nebari.local:8443:127.0.0.1" \
+            https://nebi.nebari.local:8443/)
           echo "redirect: $loc"
           echo "$loc" | grep -q 'keycloak.nebari.local/realms/nebari/protocol/openid-connect/auth' \
             || { echo "nebi did not redirect to Keycloak"; exit 1; }
 
       - name: Cleanup
         if: always()
-        run: |
-          k3d cluster delete ${{ steps.sandbox.outputs.cluster-name }} || true
-          docker network rm ${{ steps.sandbox.outputs.network-name }} 2>/dev/null || true
+        run: kind delete cluster --name ${{ steps.sandbox.outputs.cluster-name }} || true