@akash-chowdhury-24/deployhub 2.0.9 → 2.0.11

package/README.md

@@ -675,6 +675,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Docker
 
+**Verification:** Real-world verified (local and CI Docker deploys).
+
 **Prerequisites:**
 - [ ] Docker installed (`docker --version` works)
 - [ ] Registry account if pushing private images
@@ -682,20 +684,25 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 **What DeployHub automates:**
 - Starter `Dockerfile` at project root when none exists (framework-aware; skipped if you already have one)
+- `.dockerignore` when missing (never overwrites an existing one)
 - `.env.example` for image name, registry, remote `DOCKER_HOST`
 - Docker daemon connectivity test during `init`
+- Reuses the image built in the pipeline `docker` stage when present; otherwise builds from the artifact
+- Registry login + push when `DOCKER_REGISTRY_USERNAME` / `DOCKER_REGISTRY_TOKEN` are set
+- Auto-generates a unique image tag per build when `DOCKER_IMAGE_TAG` is unset (git SHA → CI run id → timestamp)
 - `docker compose up` or build/push/run during deploy
 
 **After `init`:**
-1. Set `DOCKER_IMAGE_NAME` in `.env`
-2. For private registries: set `DOCKER_REGISTRY_USERNAME` and `DOCKER_REGISTRY_TOKEN`
-3. For remote Docker: set `DOCKER_HOST` (e.g. `ssh://ubuntu@203.0.113.10`)
-4. Run `deployhub doctor`, then `git push origin main`
+1. Set `DOCKER_IMAGE_NAME` in `.env` (e.g. `myuser/myapp` for Docker Hub)
+2. For private registries (or any push): set `DOCKER_REGISTRY_USERNAME` and `DOCKER_REGISTRY_TOKEN`
+3. Leave `DOCKER_IMAGE_TAG` unset for a unique tag each build — set it only if you intentionally want a fixed tag
+4. For remote Docker: set `DOCKER_HOST` (e.g. `ssh://ubuntu@203.0.113.10`)
+5. Run `deployhub doctor`, then `git push origin main`
 
 | Variable | Description | Example | Where to get it |
 |----------|-------------|---------|-----------------|
 | `DOCKER_IMAGE_NAME` | Image repository path | `myorg/myapp` | Your registry naming |
-| `DOCKER_IMAGE_TAG` | Image tag | `latest` | Version or `latest` |
+| `DOCKER_IMAGE_TAG` | Optional fixed tag (unset → unique per build) | `latest` | Your choice; prefer unset |
 | `DOCKER_REGISTRY_URL` | Registry URL (optional) | `https://ghcr.io` | Registry docs |
 | `DOCKER_REGISTRY_USERNAME` | Registry user | `myuser` | Registry account |
 | `DOCKER_REGISTRY_TOKEN` | Registry password/token | *(secret)* | Docker Hub / GHCR PAT |
@@ -813,34 +820,55 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Kubernetes
 
+**Verification:** Real-world verified (including k3s and CI deploys).
+
 **Prerequisites:**
 - [ ] Existing Kubernetes cluster (DeployHub does not provision clusters)
 - [ ] `kubectl` installed and configured on your **local machine** (for `deployhub doctor` / manual `deployhub deploy`)
-- [ ] Cluster reachable from CI (kubeconfig secret or cloud auth)
+- [ ] Cluster reachable from CI (kubeconfig **secret contents** or cloud auth — see `KUBECONFIG` below)
+- [ ] Container registry credentials so the cluster can pull the image you push
+
+**Init prompts (what `deployhub init` asks for Kubernetes):**
+1. Path to kubeconfig file (e.g. `~/.kube/config`)
+2. Kubernetes context
+3. Namespace (defaults to project name)
+4. Container image name
+5. Registry URL (leave empty for Docker Hub)
+6. Registry username (required to push)
+7. Registry token/password (required to push)
+8. Health check URL (optional)
 
 **What DeployHub automates:**
 - Starter `k8s/deployment.yaml` and `k8s/service.yaml` when no manifests exist (skipped if you already have a `k8s/` directory or root-level Kubernetes YAML files)
 - GitHub Actions installs `kubectl` on the CI runner and writes kubeconfig from secrets (no local `kubectl` required for the automated push-to-main deploy path)
 - Lists `kubectl` contexts during `init` for easy selection
 - Auto-detects `~/.kube/config`
-- Complete `.env.example` for kubeconfig, context, namespace
+- Complete `.env.example` for kubeconfig, context, namespace, and registry settings
 - Cluster connectivity test during `init`
+- On deploy: registry login → reuse or build image → push (unique tag unless `DOCKER_IMAGE_TAG` is set) → ensure namespace exists (prompt locally / auto-create in CI) → `kubectl apply` → `kubectl set image` with the full resolved image ref → `kubectl rollout restart` when that ref is unchanged so pods pick up a new digest
 
 **After `init`:**
 1. Verify context: `kubectl config get-contexts`
-2. Create namespace if needed: `kubectl create namespace my-app`
-3. For private registries: create `imagePullSecret` and set `KUBE_IMAGE_PULL_SECRET`
-4. Copy `.env.example` → `.env`; add kubeconfig/auth to GitHub Secrets for CI
-5. Run `deployhub doctor`, then `git push origin main`
+2. Copy `.env.example` → `.env`; set `DOCKER_IMAGE_NAME`, registry username/token, and (for local deploys) `KUBECONFIG` / `KUBE_CONTEXT` / `KUBE_NAMESPACE` as needed
+3. Leave `DOCKER_IMAGE_TAG` unset for a unique tag each build — set it only if you want a fixed tag (DeployHub will still rollout-restart when the full image ref is unchanged)
+4. Namespace is created on first deploy if missing (you will be prompted locally; CI auto-creates). Or create it yourself: `kubectl create namespace my-app`
+5. For private registries: create an `imagePullSecret` and set `KUBE_IMAGE_PULL_SECRET`
+6. Add GitHub Secrets for CI (see table — **`KUBECONFIG` must be the file contents, not a path**)
+7. Run `deployhub doctor`, then `git push origin main`
+
+> **Warning — Service `targetPort`:** the default `targetPort` in generated `k8s/service.yaml` may not match your app's actual exposed port (e.g. a static nginx image serves on port **80**, not the config's default like 3000). Verify and adjust `k8s/service.yaml`'s `targetPort` (and the Deployment `containerPort` if needed) before your first deploy.
 
 | Variable | Description | Example | Where to get it |
 |----------|-------------|---------|-----------------|
-| `KUBECONFIG` | Path to kubeconfig | `~/.kube/config` | Default kubectl config |
+| `KUBECONFIG` | **Local:** path to kubeconfig. **CI (GitHub Secret):** full kubeconfig **file contents** (or base64) — not a path | `~/.kube/config` locally; paste file contents in CI | `~/.kube/config` |
 | `KUBE_CONTEXT` | Context name | `my-cluster` | `kubectl config get-contexts` |
-| `KUBE_NAMESPACE` | Target namespace | `my-app` | `kubectl get namespaces` |
-| `DOCKER_IMAGE_NAME` | Container image | `ghcr.io/org/app` | Your registry |
-| `DOCKER_IMAGE_TAG` | Image tag | `1.0.0` or `latest` | Project version or your choice |
-| `KUBE_IMAGE_PULL_SECRET` | Pull secret name | `regcred` | `kubectl create secret docker-registry` |
+| `KUBE_NAMESPACE` | Target namespace (optional; defaults to project name) | `my-app` | Your choice |
+| `DOCKER_IMAGE_NAME` | Container image repository | `myuser/myapp` or `ghcr.io/org/app` | Your registry |
+| `DOCKER_IMAGE_TAG` | Optional fixed tag (unset → unique per build) | `latest` | Prefer unset |
+| `DOCKER_REGISTRY_URL` | Registry URL (optional; empty = Docker Hub) | `https://ghcr.io` | Registry docs |
+| `DOCKER_REGISTRY_USERNAME` | Registry user (required to push) | `myuser` | Registry account |
+| `DOCKER_REGISTRY_TOKEN` | Registry password/token (required to push) | *(secret)* | Docker Hub token / GHCR PAT |
+| `KUBE_IMAGE_PULL_SECRET` | Pull secret name (optional, private registries) | `regcred` | `kubectl create secret docker-registry` |
 
 ---
 
@@ -966,8 +994,8 @@ Add these secrets in your repository (Settings → Secrets and variables → Act
 | `EC2_INSTANCE_ID`, `AWS_*` | Optional EC2 dynamic IP lookup |
 | `AZURE_SUBSCRIPTION_ID`, `AZURE_RESOURCE_GROUP`, `AZURE_VM_NAME` | Optional Azure VM IP lookup |
 | `GCP_PROJECT_ID`, `GCP_ZONE`, `GCP_INSTANCE_NAME`, `GCP_KEY_FILE` | Optional GCP VM IP lookup |
-| `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_*`, `DOCKER_HOST` | Docker deployment |
-| `KUBECONFIG`, `KUBE_CONTEXT`, `KUBE_NAMESPACE` | Kubernetes deployment |
+| `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_HOST` | Docker deployment (`DOCKER_IMAGE_TAG` optional) |
+| `KUBECONFIG`, `KUBE_CONTEXT`, `KUBE_NAMESPACE`, `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_IMAGE_TAG`, `KUBE_IMAGE_PULL_SECRET` | Kubernetes — **`KUBECONFIG` in GitHub Secrets must be the kubeconfig file contents (or base64), not a filesystem path**. `DOCKER_IMAGE_TAG`, `KUBE_NAMESPACE`, `DOCKER_REGISTRY_URL`, and `KUBE_IMAGE_PULL_SECRET` are optional |
 
 See [Deployment method guides](#deployment-method-guides) for full per-method variable tables with examples.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.9",
+  "version": "2.0.11",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/commands/doctor.js

@@ -450,6 +450,24 @@ async function runDeploymentChecks(config, envName, envConfig) {
       })
     );
 
+    checks.push(
+      await runCheck('Image tag strategy', async () => {
+        if (process.env.DOCKER_IMAGE_TAG) {
+          return {
+            name: 'Image tag strategy',
+            pass: true,
+            message: `DOCKER_IMAGE_TAG='${process.env.DOCKER_IMAGE_TAG}' is set explicitly — deploy will rollout-restart when the full image ref is unchanged; prefer unset for unique tags per build`,
+          };
+        }
+        return {
+          name: 'Image tag strategy',
+          pass: true,
+          message:
+            'DOCKER_IMAGE_TAG unset — deploy will auto-generate a unique tag (git SHA → CI id → timestamp)',
+        };
+      })
+    );
+
     checks.push(
       await runCheck('Container image pullable', async () => {
         const result = await checkImagePullability(config, process.env);

package/src/deployment/deployment-env.js

@@ -96,8 +96,12 @@ export const DEPLOYMENT_ENV_DEFS = {
     },
     {
       key: 'DOCKER_IMAGE_TAG',
-      optionalReason: 'defaults to your project version if unset',
-      comment: ['Image tag to build and deploy.'],
+      optionalReason:
+        'leave unset for a unique tag per build (git SHA → CI run id → timestamp); explicit tags are reused as-is',
+      comment: [
+        'Optional. Leave unset for a unique tag per build (git SHA, CI run id, or timestamp).',
+        'If set explicitly, the same tag is reused — Kubernetes may keep stale pods unless imagePullPolicy is Always or a rollout restart runs.',
+      ],
       example: 'latest',
       when: 'optional',
     },
@@ -324,9 +328,11 @@ export const DEPLOYMENT_ENV_DEFS = {
     },
     {
       key: 'DOCKER_IMAGE_TAG',
-      optionalReason: 'defaults to your project version, then "latest" if unset',
+      optionalReason:
+        'leave unset for a unique tag per build (git SHA → CI run id → timestamp); explicit tags are reused as-is',
       comment: [
-        'Image tag written into generated manifests and used at deploy time.',
+        'Optional image tag. Unset → DeployHub auto-generates a unique tag each build.',
+        'If set, that exact tag is used — reusing it can leave pods on a stale image (IfNotPresent) unless you rely on deploy-time rollout restart or set imagePullPolicy: Always.',
       ],
       example: 'latest',
       when: 'optional',
@@ -572,7 +578,7 @@ function getDefaultFromConfig(key, config, environments) {
     SSH_SSH_PORT: '22',
     KUBE_NAMESPACE: config?.project || 'default',
     DOCKER_IMAGE_NAME: config?.project,
-    DOCKER_IMAGE_TAG: config?.version || 'latest',
+    DOCKER_IMAGE_TAG: '',
     DOCKER_REGISTRY_URL: envEntry.dockerRegistryUrl,
     AWS_REGION: 'us-east-1',
   };

package/src/deployment/providers/kubernetes.js

@@ -6,6 +6,7 @@ import { createLogger } from '../../logger/index.js';
 import { sanitizeK8sName } from '../../utils/kubernetes-manifests.js';
 import { createDockerImageDeployContext } from '../../utils/docker-image-deploy.js';
 import { ensureKubernetesNamespace } from '../../utils/kubernetes-namespace.js';
+import { syncKubernetesDeploymentImage } from '../../utils/kubernetes-deploy-image.js';
 
 /**
  * @param {import('../../core/config.js').DeployHubConfig} config
@@ -88,22 +89,15 @@ export function createKubernetesProvider(config, envName, env = process.env) {
       env: getKubectlEnv(),
     });
 
-    const imageName = env.DOCKER_IMAGE_NAME;
-    const imageTag = env.DOCKER_IMAGE_TAG || config.version || 'latest';
-    if (imageName && config.project) {
-      await execa(
-        'kubectl',
-        kubectlArgs([
-          'set',
-          'image',
-          `deployment/${deploymentName}`,
-          `${deploymentName}=${imageName}:${imageTag}`,
-        ]),
-        { stdio: 'pipe', env: getKubectlEnv() }
-      ).catch(() => {
-        log.warn('kubectl set image skipped (deployment name may differ from project name)');
-      });
-    }
+    // Always set image to the resolved fullImage (includes registry URL prefix when set).
+    // If the live ref already equals fullImage, rollout restart so a new digest is pulled.
+    await syncKubernetesDeploymentImage({
+      deploymentName,
+      fullImage: imageOps.fullImage,
+      kubectlArgs,
+      getKubectlEnv,
+      log,
+    });
 
     log.success('Kubernetes deployment complete');
   }

package/src/utils/docker-image-deploy.js

@@ -11,6 +11,7 @@ import {
   isFrontendStaticFramework,
   isInterpretedBackendFramework,
   resolveDockerImageRef,
+  EXPLICIT_IMAGE_TAG_WARNING,
 } from './docker-image.js';
 
 /**
@@ -22,13 +23,19 @@ import {
  * @param {{ info: Function, warn: Function, success: Function }} log
  */
 export function createDockerImageDeployContext(config, env = process.env, log) {
-  const { fullImage, latestImage, legacyLatestImage, imageTag } =
+  const { fullImage, latestImage, legacyLatestImage, imageTag, tagSource } =
     resolveDockerImageRef(config, env);
   const registryUrl = env.DOCKER_REGISTRY_URL || '';
   const registryUser = env.DOCKER_REGISTRY_USERNAME || '';
   const registryToken = env.DOCKER_REGISTRY_TOKEN || '';
   const dockerHost = env.DOCKER_HOST || '';
 
+  if (tagSource === 'explicit') {
+    log.warn(EXPLICIT_IMAGE_TAG_WARNING);
+  } else {
+    log.info(`Using auto image tag '${imageTag}' (source: ${tagSource})`);
+  }
+
   function getDockerEnv() {
     /** @type {Record<string, string>} */
     const dockerEnv = { ...process.env };
@@ -324,6 +331,7 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
     fullImage,
     latestImage,
     imageTag,
+    tagSource,
     getDockerEnv,
     hasRegistryCredentials,
     dockerLogin,

package/src/utils/docker-image.js

@@ -2,20 +2,100 @@
  * Shared Docker image naming for pipeline builds and deploy.
  */
 
+import { execFileSync } from 'child_process';
+
+/** @typedef {'explicit'|'git'|'ci'|'timestamp'} ImageTagSource */
+
+export const EXPLICIT_IMAGE_TAG_WARNING =
+  'DOCKER_IMAGE_TAG is set — reusing the same tag across deploys can leave Kubernetes pods on a stale image (imagePullPolicy defaults to IfNotPresent) unless imagePullPolicy is Always or a rollout restart runs.';
+
+/**
+ * High-resolution timestamp for image tags only (artifact versioning keeps getDateVersion()).
+ * Minute prefix matches getDateVersion(); seconds+ms avoid collisions in fast rebuild loops.
+ * @param {Date} [now]
+ * @returns {string}
+ */
+export function highResImageTagFallback(now = new Date()) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, '0');
+  const d = String(now.getDate()).padStart(2, '0');
+  const h = String(now.getHours()).padStart(2, '0');
+  const min = String(now.getMinutes()).padStart(2, '0');
+  const sec = String(now.getSeconds()).padStart(2, '0');
+  const ms = String(now.getMilliseconds()).padStart(3, '0');
+  return `${y}.${m}.${d}.${h}${min}-${sec}${ms}`;
+}
+
+/**
+ * @returns {string|null}
+ */
+function defaultGetGitShortSha() {
+  try {
+    const sha = execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    return sha || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve image tag when DOCKER_IMAGE_TAG is unset: git SHA → CI id → high-res timestamp.
+ * Does not use config.version (static package versions would prevent redeploys).
+ *
+ * @param {Record<string, string|undefined>} [env]
+ * @param {{
+ *   getGitShortSha?: () => string|null,
+ *   now?: () => Date,
+ * }} [options]
+ * @returns {{ imageTag: string, tagSource: ImageTagSource }}
+ */
+export function resolveImageTag(env = process.env, options = {}) {
+  const explicit = env.DOCKER_IMAGE_TAG;
+  if (explicit) {
+    return { imageTag: explicit, tagSource: 'explicit' };
+  }
+
+  const getGitShortSha = options.getGitShortSha || defaultGetGitShortSha;
+  const gitSha = getGitShortSha();
+  if (gitSha) {
+    return { imageTag: gitSha, tagSource: 'git' };
+  }
+
+  const ciTag =
+    (env.GITHUB_SHA && String(env.GITHUB_SHA).slice(0, 7)) ||
+    env.GITHUB_RUN_ID ||
+    env.CI_COMMIT_SHORT_SHA ||
+    env.CI_PIPELINE_ID;
+  if (ciTag) {
+    return { imageTag: String(ciTag), tagSource: 'ci' };
+  }
+
+  const now = options.now ? options.now() : new Date();
+  return { imageTag: highResImageTagFallback(now), tagSource: 'timestamp' };
+}
+
 /**
  * @param {import('../core/config.js').DeployHubConfig} config
  * @param {Record<string, string|undefined>} [env]
+ * @param {{
+ *   getGitShortSha?: () => string|null,
+ *   now?: () => Date,
+ * }} [options]
  * @returns {{
  *   imageName: string,
  *   imageTag: string,
  *   fullImage: string,
  *   latestImage: string,
  *   legacyLatestImage: string,
+ *   tagSource: ImageTagSource,
  * }}
  */
-export function resolveDockerImageRef(config, env = process.env) {
+export function resolveDockerImageRef(config, env = process.env, options = {}) {
   const imageName = env.DOCKER_IMAGE_NAME || config.project;
-  const imageTag = env.DOCKER_IMAGE_TAG || config.version || 'latest';
+  const { imageTag, tagSource } = resolveImageTag(env, options);
   const registryUrl = env.DOCKER_REGISTRY_URL || '';
 
   const repository =
@@ -29,6 +109,7 @@ export function resolveDockerImageRef(config, env = process.env) {
     fullImage: `${repository}:${imageTag}`,
     latestImage: `${repository}:latest`,
     legacyLatestImage: `${config.project}:latest`,
+    tagSource,
   };
 }
 
@@ -170,6 +251,9 @@ export function describeInterpretedBackendGap(framework) {
 
 export default {
   resolveDockerImageRef,
+  resolveImageTag,
+  highResImageTagFallback,
+  EXPLICIT_IMAGE_TAG_WARNING,
   generateFrontendRuntimeDockerfile,
   generateSpringRuntimeDockerfile,
   generateGoRuntimeDockerfile,

package/src/utils/kubernetes-deploy-image.js

@@ -0,0 +1,111 @@
+import { execa } from 'execa';
+
+/**
+ * After kubectl apply, set the Deployment container image to fullImage and
+ * rollout-restart only when the live image ref is already identical (same
+ * registry + name + tag), so a new digest under a reused tag still redeploys.
+ *
+ * @param {{
+ *   deploymentName: string,
+ *   fullImage: string,
+ *   kubectlArgs: (args: string[]) => string[],
+ *   getKubectlEnv: () => NodeJS.ProcessEnv,
+ *   log: { info: Function, warn: Function, success?: Function },
+ *   execaFn?: typeof execa,
+ * }} options
+ * @returns {Promise<{ beforeImage: string, setImage: boolean, restarted: boolean }>}
+ */
+export async function syncKubernetesDeploymentImage(options) {
+  const {
+    deploymentName,
+    fullImage,
+    kubectlArgs,
+    getKubectlEnv,
+    log,
+    execaFn = execa,
+  } = options;
+
+  const beforeImage = await readDeploymentContainerImage({
+    deploymentName,
+    kubectlArgs,
+    getKubectlEnv,
+    execaFn,
+  });
+
+  let setImage = false;
+  try {
+    await execaFn(
+      'kubectl',
+      kubectlArgs([
+        'set',
+        'image',
+        `deployment/${deploymentName}`,
+        `${deploymentName}=${fullImage}`,
+      ]),
+      { stdio: 'pipe', env: getKubectlEnv() }
+    );
+    setImage = true;
+  } catch {
+    log.warn('kubectl set image skipped (deployment name may differ from project name)');
+  }
+
+  // Compare full image refs (registry + name + tag), not tag alone.
+  if (beforeImage === fullImage) {
+    log.info(
+      `Image ref unchanged (${fullImage}) — running rollout restart so pods pick up a new digest`
+    );
+    await execaFn(
+      'kubectl',
+      kubectlArgs(['rollout', 'restart', `deployment/${deploymentName}`]),
+      { stdio: 'inherit', env: getKubectlEnv() }
+    );
+    return { beforeImage, setImage, restarted: true };
+  }
+
+  return { beforeImage, setImage, restarted: false };
+}
+
+/**
+ * @param {{
+ *   deploymentName: string,
+ *   kubectlArgs: (args: string[]) => string[],
+ *   getKubectlEnv: () => NodeJS.ProcessEnv,
+ *   execaFn: typeof execa,
+ * }} options
+ * @returns {Promise<string>}
+ */
+async function readDeploymentContainerImage(options) {
+  const { deploymentName, kubectlArgs, getKubectlEnv, execaFn } = options;
+
+  const jsonpath = `{.spec.template.spec.containers[?(@.name=="${deploymentName}")].image}`;
+  try {
+    const { stdout } = await execaFn(
+      'kubectl',
+      kubectlArgs(['get', 'deployment', deploymentName, '-o', `jsonpath=${jsonpath}`]),
+      { stdio: 'pipe', env: getKubectlEnv() }
+    );
+    const trimmed = String(stdout || '').trim();
+    if (trimmed) return trimmed;
+  } catch {
+    // fall through to containers[0]
+  }
+
+  try {
+    const { stdout } = await execaFn(
+      'kubectl',
+      kubectlArgs([
+        'get',
+        'deployment',
+        deploymentName,
+        '-o',
+        'jsonpath={.spec.template.spec.containers[0].image}',
+      ]),
+      { stdio: 'pipe', env: getKubectlEnv() }
+    );
+    return String(stdout || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+export default { syncKubernetesDeploymentImage };

package/src/utils/kubernetes-manifests.js

@@ -83,6 +83,7 @@ spec:
     spec:
 ${pullSecretBlock}      containers:
       - name: ${name}
+        # Image tag is overwritten at deploy time (kubectl set image uses the resolved build tag)
         image: ${image}
         ports:
         - containerPort: ${port}