fix: harden d601 k3s guards

scripts/src/ci.ts

@@ -13,9 +13,10 @@ import {
   parseArtifactRegistryOptions,
   type ArtifactRegistryReadonlyProbe,
 } from "./artifact-registry";
+import { d601K3sGuardShellLines, d601NativeKubeconfig } from "./d601-k3s-guard";
 
 const d601ProviderId = "D601";
-const d601Kubeconfig = "/etc/rancher/k3s/k3s.yaml";
+const d601Kubeconfig = d601NativeKubeconfig;
 const tektonPipelineVersion = "v1.12.0";
 const tektonTriggersVersion = "v0.34.0";
 const tektonPipelineReleaseUrl = `https://infra.tekton.dev/tekton-releases/pipeline/previous/${tektonPipelineVersion}/release.yaml`;
@@ -503,7 +504,7 @@ function publishPreflightFailedScopes(preflight: PublishPreflight): string[] {
 function ciRunnerPreflightScript(sourceHostPath: string): string {
   return [
     "set -euo pipefail",
-    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    ...d601K3sGuardShellLines(d601Kubeconfig),
     "printf 'provider_host_ssh=ok\\n'",
     "printf 'kubectl='",
     "command -v kubectl >/dev/null && printf 'ok\\n' || { printf 'missing\\n'; exit 127; }",
@@ -530,11 +531,12 @@ function keyValueBool(stdout: string, key: string): boolean {
   const match = new RegExp(`^${key}=(.*)$`, "mu").exec(stdout);
   if (match === null) return false;
   const value = match[1]?.trim().toLowerCase() ?? "";
-  return value === "true" || value === "ok";
+  return value === "true" || value === "ok" || value === "pass" || value.startsWith("pass ");
 }
 
 function backendCoreCiRunnerReady(result: DispatchResult): boolean {
   return result.ok
+    && keyValueBool(result.stdout, "d601_native_k3s_guard")
     && keyValueBool(result.stdout, "kubectl")
     && keyValueBool(result.stdout, "docker")
     && keyValueBool(result.stdout, "namespace")
@@ -751,7 +753,7 @@ async function runRemoteKubectl(script: string, waitMs = 60_000, remoteTimeoutMs
 async function runRemoteKubectlRaw(script: string, waitMs = 60_000, remoteTimeoutMs = 45_000): Promise<DispatchResult> {
   const command = [
     "set -euo pipefail",
-    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    ...d601K3sGuardShellLines(d601Kubeconfig, { passOutput: "stderr" }),
     script,
   ].join("\n");
   return dispatchSsh(command, waitMs, remoteTimeoutMs);
@@ -857,7 +859,7 @@ async function remoteApplyManifest(path: string): Promise<void> {
   if (!upload.ok) throw new Error(`failed to upload manifest ${path}: ${upload.stderr || upload.stdout}`);
   const script = [
     "set -euo pipefail",
-    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    ...d601K3sGuardShellLines(d601Kubeconfig),
     "tmp=$(mktemp /tmp/unidesk-ci-apply.XXXXXX.yaml)",
     `b64_path=${shellQuote(b64Path)}`,
     "trap 'rm -f \"$tmp\" \"$b64_path\"' EXIT",
@@ -872,7 +874,7 @@ async function prewarmCiRuntimeImages(): Promise<void> {
   const images = ciRuntimeImages.map(shellQuote).join(" ");
   const script = [
     "set -euo pipefail",
-    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    ...d601K3sGuardShellLines(d601Kubeconfig),
     "export DOCKER_CONFIG=/tmp/unidesk-ci-docker-config",
     "mkdir -p \"$DOCKER_CONFIG\"",
     "printf '{}\\n' > \"$DOCKER_CONFIG/config.json\"",
@@ -946,7 +948,7 @@ async function install(): Promise<Record<string, unknown>> {
   await prewarmCiRuntimeImages();
   const installTektonScript = [
     "set -euo pipefail",
-    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    ...d601K3sGuardShellLines(d601Kubeconfig),
     `kubectl apply -f ${shellQuote(tektonPipelineReleaseUrl)}`,
     "kubectl wait --for=condition=Available deployment --all -n tekton-pipelines --timeout=900s",
     `kubectl apply -f ${shellQuote(tektonTriggersReleaseUrl)}`,
@@ -1321,7 +1323,7 @@ async function waitForPipelineRun(name: string, waitMs: number): Promise<Dispatc
   if (waitMs <= 0) return null;
   const command = [
     "set -euo pipefail",
-    `export KUBECONFIG=${shellQuote(d601Kubeconfig)}`,
+    ...d601K3sGuardShellLines(d601Kubeconfig),
     `printf 'waiting_pipelinerun=%s\\n' ${shellQuote(name)}`,
     `deadline=$((SECONDS + ${Math.ceil(waitMs / 1000)}))`,
     "while [ \"$SECONDS\" -lt \"$deadline\" ]; do",
@@ -1511,6 +1513,7 @@ async function publishUserServicePreflight(
 
   const probeScript = [
     "set -euo pipefail",
+    ...d601K3sGuardShellLines(d601Kubeconfig),
     "printf 'provider_host_ssh=ok\\n'",
     "command -v bash >/dev/null",
     "command -v docker >/dev/null",