chore(cascade): gate GHA k8s deploy → stage

[evereq]

Cascades the GHA_K8S_DEPLOY_ENABLED gate to stage so it reaches the 14 Work repos via the platform's force-push sync.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 898c6ef4-d584-4fbd-8ced-0c95d2648a89

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Adds an explicit opt-in gate to the Kubernetes GitHub Actions deployment job. Deployments now run only when GHA_K8S_DEPLOY_ENABLED is exactly true, preventing platform-managed repositories from attempting Kubernetes access from runners that cannot reach the cluster.

The deployment condition was executed against both supported workflow entry points. With the variable unset, workflow_dispatch and workflow_call both skip the job; with true, both schedule it; and TRUE remains disabled. This matches the documented server-side platform deployment model while retaining an opt-in path for forks that manage a reachable cluster.

Confidence Score: 5/5

T-Rex Logs

What T-Rex did

• Ran the pre-check script k8s-job-gate-01-before.py from /home/user/repo and it exited with code 0.
• Observed that an absent variable skipped workflow_dispatch and workflow_call, while exact true was scheduled for both and TRUE was skipped, indicating the gate behaves as documented under the platform-managed deployment contract.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "ci(k8s): gate the GitHub Actions deploy ..." | Re-trigger Greptile}