ci: update workflow to auto-patch admin/apps after build

.gitea/workflows/build.yaml

@@ -30,7 +30,6 @@ jobs:
           tags: |
             type=sha,format=long
             type=ref,event=branch
-            type=semver,pattern={{version}}
 
       - name: Build and push
         uses: docker/build-push-action@v6
@@ -41,3 +40,21 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - name: Update k8s manifest in admin/apps
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          IMAGE_TAG: ${{ steps.meta.outputs.tags }}
+        run: |
+          SHA=$(echo "$IMAGE_TAG" | grep -oE 'sha-[a-f0-9]+' | head -1)
+          if [ -z "$SHA" ]; then SHA=$(echo "$IMAGE_TAG" | grep -oE 'main-[a-f0-9]+' | head -1); fi
+          if [ -z "$SHA" ]; then echo "No SHA tag found"; exit 1; fi
+
+          git clone "https://admin:${GITEA_TOKEN}@git.kubebase.de/admin/apps.git" /tmp/apps
+          cd /tmp/apps
+          sed -i "s|image: git.kubebase.de/admin/tool-evaluator:.*|image: git.kubebase.de/admin/tool-evaluator:${SHA}|" apps/toolrate/overlays/k3s/kustomization.yaml
+          git config user.name "Gitea Actions"
+          git config user.email "actions@git.kubebase.de"
+          git add -A
+          git diff --cached --quiet || git commit -m "chore: update toolrate image to ${SHA}"
+          git push