fix(ci): skip heavy jobs on renovate branches, automerge digest and patch

Renovate branches only carry version/digest bumps, so scan-deps, test-backend, test-frontend and build just burn runner time on the box that also serves prod. Static checks and validate still run. Digest and patch updates automerge (playwright, helm and major rules below still override to no-automerge). Also replaces deprecated helm --atomic with --wait --rollback-on-failure.

.gitea/workflows/deploy-lib.sh

@@ -489,7 +489,7 @@ rollback_workloads() {
   local -a recovered=()
   while read -r kind ns name; do
     [ -n "${kind:-}" ] || continue
-    # Helm-owned workloads are already rolled back by the release's --atomic
+    # Helm-owned workloads are already rolled back by the release's --rollback-on-failure
     # upgrade. `rollout undo` here would step back to the revision Helm just
     # escaped (the failed one), so leave them for the operator instead.
     if kubectl get "${kind}/${name}" -n "$ns" -o jsonpath='{.metadata.annotations}' 2>/dev/null | grep -q 'meta.helm.sh/release-name'; then
@@ -548,7 +548,7 @@ helm_release_status() {
 }
 
 # recover_pending_release <release> <namespace>
-# Rolls a release out of a pending-* state left by a failed --atomic upgrade
+# Rolls a release out of a pending-* state left by a failed upgrade with --rollback-on-failure
 # whose own rollback never completed. Without this every future upgrade errors
 # out until a human runs `helm rollback`. Passes through releases that are not
 # pending (deployed, failed, not-found). Returns non-zero when the release is
@@ -593,22 +593,23 @@ upgrade_helm_releases() {
     helm repo add "${repo%% *}" "${repo#* }" >/dev/null 2>&1 || true
     helm repo update "${repo%% *}" >/dev/null 2>&1 || true
     log "Upgrading $release ($chart $version)"
-    # A previous --atomic run whose own rollback never finished leaves the
+    # A previous run with --rollback-on-failure whose own rollback never finished leaves the
     # release in pending-*, which blocks every future upgrade. Recover first
     # so one wedged revision cannot wedge the pipeline forever.
     if ! recover_pending_release "$release" "$namespace"; then
       echo "ERROR: $release is stuck and automatic rollback did not recover it, run 'helm rollback $release -n $namespace' by hand."
       return 1
     fi
-    # --atomic rolls the release back when the upgrade times out or the workloads
-    # it touches never become ready, so a bad chart bump is not left half applied.
+    # --rollback-on-failure (+ --wait) rolls the release back when the upgrade
+    # times out or the workloads it touches never become ready, so a bad chart
+    # bump is not left half applied. (--atomic was this combo; deprecated.)
     if ! helm upgrade --install "$release" "$chart" \
       --namespace "$namespace" \
       --version "$version" \
       --values "$REPO/$values" \
-      --atomic --cleanup-on-fail --timeout 10m; then
+      --wait --rollback-on-failure --cleanup-on-fail --timeout 10m; then
       echo "WARN: upgrade of $release failed, checking release state"
-      # --atomic already attempted its own rollback; finish the job when that
+      # --rollback-on-failure already attempted its own rollback; finish the job when that
       # rollback never completed, otherwise the release stays pending-* and
       # blocks every future run.
       if ! recover_pending_release "$release" "$namespace"; then