feat(web-sentinel): add dashboard manual trigger

scripts/src/hwlab-node-web-sentinel-cicd.ts

@@ -29,7 +29,7 @@ export type WebProbeSentinelImageAction = "status" | "build";
 export type WebProbeSentinelControlPlaneAction = "plan" | "apply" | "status" | "trigger-current";
 export type WebProbeSentinelPublishAction = "publish-current";
 export type WebProbeSentinelMaintenanceAction = "status" | "start" | "stop";
-export type WebProbeSentinelDashboardAction = "verify" | "screenshot";
+export type WebProbeSentinelDashboardAction = "verify" | "screenshot" | "trigger";
 export type WebProbeSentinelReportView = "summary" | "turn-summary" | "findings" | "trace-frame" | "auth-session-switch-summary";
 
 export type WebProbeSentinelOptions =
@@ -1098,6 +1098,22 @@ function renderSentinelManifests(
       kind: "ServiceAccount",
       metadata: { name: stringAt(runtime, "serviceAccountName"), namespace, labels },
     },
+    {
+      apiVersion: "rbac.authorization.k8s.io/v1",
+      kind: "Role",
+      metadata: { name: `${deploymentName}-manual-trigger`, namespace, labels },
+      rules: [
+        { apiGroups: ["batch"], resources: ["cronjobs"], verbs: ["get"] },
+        { apiGroups: ["batch"], resources: ["jobs"], verbs: ["create", "get", "list"] },
+      ],
+    },
+    {
+      apiVersion: "rbac.authorization.k8s.io/v1",
+      kind: "RoleBinding",
+      metadata: { name: `${deploymentName}-manual-trigger`, namespace, labels },
+      subjects: [{ kind: "ServiceAccount", name: stringAt(runtime, "serviceAccountName"), namespace }],
+      roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: `${deploymentName}-manual-trigger` },
+    },
     {
       apiVersion: "v1",
       kind: "PersistentVolumeClaim",