fix(gitops-update): install kustomize without sudo, mirroring the yq pattern

[bedatty]

GitHub Actions Shared Workflows

---

Description

The Install kustomize step in gitops-update.yml used sudo install -m 755 /tmp/kustomize /usr/local/bin/kustomize, which assumes sudo is available on the runner. The update_gitops job runs on ${{ vars.GITOPS_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }}, and the organization's self-hosted pool has no sudo — the step fails with sudo: command not found.

This caused a real production failure: in LerianStudio/ungoliant-controller, the v2.1.0-beta.10 release (run 30110283556) built and pushed the image successfully, but update_gitops failed at this step, cascading into a cancelled ArgoCD Sync — the image was never reconciled into the cluster.

The fix mirrors the pattern already used by the two other binary installers in the same file (Install yq, lines 224-240, and the argocd CLI install, line ~913): install into a user-writable directory and export it via $GITHUB_PATH, so no elevated privileges and no write to /usr/local/bin are needed.

  tar -xzf /tmp/kustomize.tar.gz -C /tmp
- sudo install -m 755 /tmp/kustomize /usr/local/bin/kustomize
+ mkdir -p ~/.local/bin
+ install -m 755 /tmp/kustomize ~/.local/bin/kustomize
+ echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+ export PATH="$HOME/.local/bin:$PATH"
  kustomize version

The existing comment explaining the kustomize/vX.Y.Z tag URL-encoding (a separate historical bug) is preserved untouched.

Repo-wide sudo audit — the remaining sudo usages were reviewed and intentionally left as-is:

Location	Usage	Verdict
gitops-update.yml:258	sudo install ... /usr/local/bin/kustomize	fixed in this PR
go-pr-analysis.yml (6 occurrences)	sudo apt-get install of inputs.system_packages	out of scope — runs on the separate GENERAL_RUNNERS pool, and arbitrary apt packages have no ~/.local/bin equivalent
src/lint/{shellcheck,composite-schema,deployment-matrix}	sudo apt-get install (shellcheck, python3-yaml)	out of scope — only consumed by self-* workflows in this repo, on blacksmith runners

gitops-update.yml now contains zero sudo invocations.

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None. No input, output, or secret changed. Only the installation path of the kustomize binary changed — it is exported via $GITHUB_PATH, so all subsequent steps resolve it identically. The new path also works on GitHub-hosted and blacksmith runners, so no caller sees a behavior difference.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Notes on what was and was not verified:

• YAML parsed successfully; the step body is unchanged apart from the four lines above.
• The step is gated by if: inputs.gitops_layout == 'kustomize', unchanged — helmfile callers are unaffected.
• Not yet validated on a caller. This step only fails on the sudo-less self-hosted pool, which cannot be reached from a branch-pinned test without a released tag. End-to-end confirmation requires merge + a new tag, then bumping ungoliant-controller's pin in .github/workflows/release.yml from @v1.47.4 to the new tag and re-triggering the v2.1.0-beta.10 release to confirm update_gitops and the ArgoCD Sync both complete.

Caller repo / workflow run: ungoliant-controller run 30110283556 — this is the failing run that surfaced the bug, not a validation of the fix.

Related Issues

None.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 727804cc-7cf8-48c9-a805-02c9fc92d2b9

📥 Commits

Reviewing files that changed from the base of the PR and between 5be7f94 and 436fa31.

📒 Files selected for processing (1)

• .github/workflows/gitops-update.yml

---

Summary by CodeRabbit

• Chores
  • Improved the automated deployment workflow’s setup of the kustomize command-line tool.
  • Ensured kustomize is available to subsequent workflow steps without requiring elevated system permissions.

Walkthrough

The GitOps workflow now installs kustomize in ~/.local/bin instead of /usr/local/bin, makes the directory available through GITHUB_PATH and PATH, and avoids requiring sudo for subsequent kustomize commands.

Changes

GitOps workflow tooling

Layer / File(s)	Summary
Configure user-local kustomize installation .github/workflows/gitops-update.yml	Creates ~/.local/bin, installs the kustomize executable there, and exposes the directory to subsequent workflow steps.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ferr3ira-gabriel

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is specific and accurately summarizes the main workflow change: removing sudo from the kustomize install step.
Description check	✅ Passed	The description follows the template and includes the change, type, breaking changes, testing, and related issues sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/kustomize-install-without-sudo

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	1 file(s)	✅ success
Action Lint	1 file(s)	✅ success
Pinned Actions	1 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	1 file(s)	✅ success
Shell Check	1 file(s)	✅ success
README Check	1 file(s)	✅ success
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 2 issue(s): 2 Medium

Severity	Rule	File	Message
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:164	Potential unsafe checkout of untrusted pull request on non-privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:182	Potential unsafe checkout of untrusted pull request on non-privileged workflow.

---

_{🔍 View full scan logs | 🛡️ Security tab}