From d493066f0b37fbb8b2ea76b355a9b4ec8d7544ab Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sat, 4 Jul 2026 17:52:47 +0000
Subject: [PATCH] fix: verify postprocessed runtime gitops

---
 scripts/native/cicd/hwlab-node-control-plane-refresh.mjs | 2 +-
 scripts/native/hwlab/runtime-gitops-pipeline-guard.mjs   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs b/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs
index 0bc25814..b3d6b088 100644
--- a/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs
+++ b/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs
@@ -378,7 +378,7 @@ function injectRuntimeGitopsCommands(script) {
   return String(script).replace(
     /(node scripts\/run-bun\.mjs scripts\/gitops-render\.mjs[^\n]*--use-deploy-images[^\n]*)/g,
     (match) => {
-      if (match.includes("--check")) return `${match}\n${verify}`;
+      if (match.includes("--check")) return verify;
       return `${match}\n${postprocess}`;
     },
   );
diff --git a/scripts/native/hwlab/runtime-gitops-pipeline-guard.mjs b/scripts/native/hwlab/runtime-gitops-pipeline-guard.mjs
index 3169eb90..77e0372e 100644
--- a/scripts/native/hwlab/runtime-gitops-pipeline-guard.mjs
+++ b/scripts/native/hwlab/runtime-gitops-pipeline-guard.mjs
@@ -97,7 +97,7 @@ function injectRuntimeGitopsCommands(script) {
   return String(script).replace(
     /(node scripts\/run-bun\.mjs scripts\/gitops-render\.mjs[^\n]*--use-deploy-images[^\n]*)/g,
     (match) => {
-      if (match.includes("--check")) return hasVerify(script) ? match : `${match}\n${verify}`;
+      if (match.includes("--check")) return hasVerify(script) ? match : verify;
       return hasPostprocess(script) ? match : `${match}\n${postprocess}`;
     },
   );