Summary

Extend the KWOK deployer matrix to validate filesystem (Git-source) bundle round-trips for argocd and flux — not just the OCI lanes added in #843 / PR #956.

Motivation

Today's coverage after PR #956:

The Chainsaw layer validates the bundle's shape on disk; the KWOK OCI lanes validate that a controller can pull the bundle from an in-cluster OCI registry and reconcile (or for flux-oci, apply). What's still uncovered is filesystem-bundle round-trip: aicr bundle --output ./dir -> Git server -> Argo CD Application / Flux GitRepository -> reconcile.

This matters because production users frequently choose Git as their GitOps source. A regression in the argocd (non-OCI) deployer's app-of-apps.yaml shape, or the flux (non-OCI) deployer's gitrepo-*.yaml source CRs, would slip through current CI.

Proposed approach

Install a Gitea pod in the aicr-registry namespace as part of kwok/scripts/install-infra.sh, mirroring the in-cluster registry:2 pattern. Each KWOK matrix cell:

1. aicr bundle --recipe ... --output ./bundle (filesystem output).
2. Push the bundle to http://gitea.aicr-registry.svc.cluster.local:3000/aicr/<recipe>.git.
3. Render an Argo CD Application (or Flux GitRepository + Kustomization) pointing at that URL.
4. Wait for sync gate (same terminal-pass framing as argocd-oci / flux-oci).

Two new matrix lanes: argocd-git and flux-git. Tier 1 + Tier 3 only (Tier 2 stays helm-only per ADR-008).

Effort estimate

~1-2 days of work plus likely a round of KWOK-fidelity iteration (the same shape of pattern-discovery the OCI lanes went through). Doubles the matrix size — ~32 new CI cells across the existing 16 recipes.

Notes

• Gitea image is multi-arch and well-maintained; we can pin via .settings.yaml::testing_tools.gitea_image.
• Repository-creds shapes for Argo CD (secret-type: repo-creds) and Flux (Secret referenced by GitRepository.spec.secretRef) are documented and well-understood.
• This is the "filesystem-shape round-trip" half of the bundle-validation matrix; PR feat(ci,bundler): validate deployer OCI bundles matrix in KWOK #956 covers the "OCI-shape round-trip" half.

Acceptance criteria

• Gitea installed via install-infra.sh when DEPLOYER is argocd-git or flux-git.
• argocd-git lane added to kwok-recipes.yaml Tier 1 + Tier 3.
• flux-git lane added to kwok-recipes.yaml Tier 1 + Tier 3.
• Sync gate reuses the existing wait_for_argocd_sync / wait_for_flux_sync terminal-pass shape (no per-lane divergence).
• docs/contributor/kwok-testing.md updated with the new lanes.
• ADR-008 amended (or new ADR-009 supersedes the filesystem-coverage section).

Related

• PR feat(ci,bundler): validate deployer OCI bundles matrix in KWOK #956 (this PR adds argocd-oci, argocd-helm-oci, flux-oci)
• ADR-008
• Issue CI does not validate deployer-specific bundle output (Argo CD bundles can ship broken) #843 (parent)