security: use canonical gitops-release reusable workflow

.github/workflows/bimross-website-image.yml

@@ -101,108 +101,46 @@
             -d "${PAYLOAD}" \
             -w "\nHTTP %{http_code}\n" || true
 
-  gitops-release:
+  version:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
-    needs:
-      - build-and-publish
-    env:
-      RANCHER_ADMIN_REPO: bimross/rancher-admin
+    outputs:
+      version: ${{ steps.compute.outputs.version }}
+      target_env: ${{ steps.compute.outputs.target_env }}
+      manifest_paths: ${{ steps.compute.outputs.manifest_paths }}
+      commit_subject: ${{ steps.compute.outputs.commit_subject }}
     steps:
-      - name: Compute release version
-        id: version
+      - id: compute
         run: |
           TAG="${GITHUB_REF_NAME}"
           VERSION="${TAG#v}"
-          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
-
-      - name: Checkout rancher-admin
-        uses: actions/checkout@v6
-        with:
-          repository: ${{ env.RANCHER_ADMIN_REPO }}
-          ref: master
-          token: ${{ secrets.RANCHER_ADMIN_REPO_TOKEN }}
-          path: rancher-admin
-          fetch-depth: 0
+          TARGET=""
+          MANIFEST="admin/apps/bimross-website/deployment.yaml"
+          SUBJECT="release(bimross-website): bump image to ${VERSION}"
+          {
+            echo "version=${VERSION}"
+            echo "target_env=${TARGET}"
+            echo "commit_subject=${SUBJECT}"
+            echo 'manifest_paths<<EOF'
+            printf '%s\n' "${MANIFEST}"
+            echo 'EOF'
+          } >> "${GITHUB_OUTPUT}"
 
-      - name: Update bimross-website image tag
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-          import os
-          import re
-
-          version = os.environ["VERSION"]
-          path = Path("rancher-admin/admin/apps/bimross-website/deployment.yaml")
-          content = path.read_text()
-          pattern = r"(geeemoney/bimross-website:)[^\s\"']+"
-          updated = re.sub(pattern, lambda m: f"{m.group(1)}{version}", content)
-          path.write_text(updated)
-          PY
-
-      - name: Commit manifest updates to PR branch
-        id: commit
-        working-directory: rancher-admin
-        env:
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          if git diff --quiet; then
-            echo "No manifest changes to commit."
-            echo "changed=false" >> "${GITHUB_OUTPUT}"
-            exit 0
-          fi
-          git config user.name "bimross-website-ci"
-          git config user.email "[email protected]"
-          MSG="release(bimross-website): bump image to ${VERSION}"
-          BRANCH="gitops/bimross-website-${VERSION}"
-          # Idempotent branch: if a prior run created it, reset and force-push so
-          # the PR reflects the latest manifest. Branch name embeds version, so
-          # collisions only happen on workflow reruns for the same tag.
-          git checkout -B "${BRANCH}"
-          git add admin/apps/bimross-website/deployment.yaml
-          git commit -m "${MSG}"
-          git push --force-with-lease origin "${BRANCH}"
-          echo "changed=true" >> "${GITHUB_OUTPUT}"
-          echo "branch=${BRANCH}" >> "${GITHUB_OUTPUT}"
-          echo "title=${MSG}" >> "${GITHUB_OUTPUT}"
-
-      - name: Open or update PR and enable auto-merge
-        if: steps.commit.outputs.changed == 'true'
-        working-directory: rancher-admin
-        env:
-          GH_TOKEN: ${{ secrets.RANCHER_ADMIN_REPO_TOKEN }}
-          BRANCH: ${{ steps.commit.outputs.branch }}
-          TITLE: ${{ steps.commit.outputs.title }}
-          VERSION: ${{ steps.version.outputs.version }}
-          SOURCE_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        run: |
-          BODY=$(printf '%s\n' \
-            "Automated GitOps bump from \`${GITHUB_REPOSITORY}\`." \
-            "" \
-            "- version: \`${VERSION}\`" \
-            "- image: \`geeemoney/bimross-website:${VERSION}\`" \
-            "- source run: ${SOURCE_RUN_URL}" \
-            "" \
-            "Org ruleset on \`master\` requires PR review." \
-            "Auto-merge (squash) is enabled; PR will merge once approvals land.")
-          EXISTING=$(gh pr list --head "${BRANCH}" --state open --json number --jq '.[0].number' || true)
-          if [ -n "${EXISTING}" ]; then
-            echo "Reusing existing PR #${EXISTING} for branch ${BRANCH}."
-            PR_NUMBER="${EXISTING}"
-            gh pr edit "${PR_NUMBER}" --title "${TITLE}" --body "${BODY}" || true
-          else
-            gh pr create \
-              --base master \
-              --head "${BRANCH}" \
-              --title "${TITLE}" \
-              --body "${BODY}"
-            PR_NUMBER=$(gh pr list --head "${BRANCH}" --state open --json number --jq '.[0].number')
-            echo "Created PR #${PR_NUMBER}."
-          fi
-          if gh pr merge "${PR_NUMBER}" --squash --auto; then
-            echo "Auto-merge enabled on PR #${PR_NUMBER}."
-          else
-            echo "Could not enable auto-merge on PR #${PR_NUMBER}; leaving it open for manual merge."
-          fi
+  gitops-release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build-and-publish
+      - version
+    concurrency:
+      group: bimross-website-release
+      cancel-in-progress: false
+    uses: BimRoss/.github/.github/workflows/gitops-release.yml@91ea84482a8b74acf0f63feebce7187bea0ecc30 # v1
+    secrets: inherit
+    with:
+      app_slug: bimross-website
+      version: ${{ needs.version.outputs.version }}
+      target_env: ${{ needs.version.outputs.target_env }}
+      images: |
+        geeemoney/bimross-website
+      manifest_paths: ${{ needs.version.outputs.manifest_paths }}
+      commit_subject: ${{ needs.version.outputs.commit_subject }}