fix: configure Nexus registry and Rancher deployment

2026-09-07 14:22:45 +07:00
parent 132d8efbc6
commit c1b6a2ae9c
3 changed files with 410 additions and 410 deletions
@@ -1,38 +0,0 @@
-name: Test Secrets
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Test Registry Secrets
-        shell: bash
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          set -e
-
-          echo "=========================================="
-          echo "TEST GITEA SECRETS"
-          echo "=========================================="
-
-          echo "REGISTRY_USER length: ${#REGISTRY_USER}"
-          echo "REGISTRY_PASSWORD length: ${#REGISTRY_PASSWORD}"
-
-          if [ -z "$REGISTRY_USER" ]; then
-            echo "ERROR: REGISTRY_USER TIDAK TERBACA"
-            exit 1
-          fi
-
-          if [ -z "$REGISTRY_PASSWORD" ]; then
-            echo "ERROR: REGISTRY_PASSWORD TIDAK TERBACA"
-            exit 1
-          fi
-
-          echo "SECRET BERHASIL TERBACA"
@@ -1,376 +1,38 @@
-name: CI/CD Pipeline to Rancher - SIDATA
+name: Test Secrets

 on:
-push:
-branches:
- main
+  push:
+    branches:
+      - main

 jobs:
-build-and-deploy:
-runs-on: ubuntu-latest
-
-env:
-  # ============================================================
-  # Proxy
-  # ============================================================
-  HTTP_PROXY: http://10.15.3.20:80
-  HTTPS_PROXY: http://10.15.3.20:80
-  http_proxy: http://10.15.3.20:80
-  https_proxy: http://10.15.3.20:80
-
-  # ============================================================
-  # Internal network bypass proxy
-  # ============================================================
-  NO_PROXY: localhost,127.0.0.1,10.15.39.0/24,10.81.2.0/24,10.42.0.0/16,10.43.0.0/16,registry-nexus-bpkd.drc-bpkd.data-center.id,registry-bpkd.drc-bpkd.data-center.id,.drc-bpkd.data-center.id,.bpkd.jakarta.go.id
-
-  no_proxy: localhost,127.0.0.1,10.15.39.0/24,10.81.2.0/24,10.42.0.0/16,10.43.0.0/16,registry-nexus-bpkd.drc-bpkd.data-center.id,registry-bpkd.drc-bpkd.data-center.id,.drc-bpkd.data-center.id,.bpkd.jakarta.go.id
-
-steps:
-
-  # ============================================================
-  # 1. Check Container Engine
-  # ============================================================
-  - name: Check Container Engine
-    shell: bash
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "CONTAINER ENGINE"
-      echo "=========================================="
-
-      which docker
-      docker version
-
-      echo ""
-      echo "Docker socket:"
-      ls -l /var/run/docker.sock || true
-
-  # ============================================================
-  # 2. Check Registry Connectivity
-  # ============================================================
-  - name: Check Nexus Connectivity
-    shell: bash
-    run: |
-      set -e
-
-      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
-
-      echo "=========================================="
-      echo "CHECK NEXUS"
-      echo "=========================================="
-
-      echo "DNS:"
-      getent hosts "$REGISTRY"
-
-      echo ""
-      echo "Registry API:"
-
-      # HTTP 401 adalah NORMAL untuk registry private.
-      # Yang penting koneksi HTTPS berhasil.
-      HTTP_CODE=$(curl \
-        --silent \
-        --show-error \
-        --output /tmp/nexus-response.txt \
-        --write-out "%{http_code}" \
-        --connect-timeout 10 \
-        "https://${REGISTRY}/v2/" || true)
-
-      echo "HTTP status: ${HTTP_CODE}"
-
-      if [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "200" ]; then
-        echo "Nexus dapat diakses."
-      else
-        echo "ERROR: Nexus tidak dapat diakses."
-        cat /tmp/nexus-response.txt || true
-        exit 1
-      fi
-
-  # ============================================================
-  # 3. Check Registry Credentials
-  # ============================================================
-  - name: Check Registry Credentials
-    shell: bash
-    env:
-      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "CHECK REGISTRY CREDENTIALS"
-      echo "=========================================="
-
-      echo "REGISTRY_USER length: ${#REGISTRY_USER}"
-      echo "REGISTRY_PASSWORD length: ${#REGISTRY_PASSWORD}"
-
-      if [ -z "$REGISTRY_USER" ]; then
-        echo "ERROR: REGISTRY_USER kosong."
-        echo "Periksa Repository -> Settings -> Actions -> Secrets."
-        exit 1
-      fi
-
-      if [ -z "$REGISTRY_PASSWORD" ]; then
-        echo "ERROR: REGISTRY_PASSWORD kosong."
-        echo "Periksa Repository -> Settings -> Actions -> Secrets."
-        exit 1
-      fi
-
-      echo "Registry credentials tersedia."
-
-  # ============================================================
-  # 4. Login Nexus
-  # ============================================================
-  - name: Login Nexus
-    shell: bash
-    env:
-      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-    run: |
-      set -e
-
-      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
-
-      echo "=========================================="
-      echo "LOGIN NEXUS"
-      echo "=========================================="
-
-      printf '%s' "$REGISTRY_PASSWORD" | \
-        docker login "$REGISTRY" \
-          --username "$REGISTRY_USER" \
-          --password-stdin
-
-      echo "Login Nexus berhasil."
-
-  # ============================================================
-  # 5. Pull Base Image
-  # ============================================================
-  - name: Pull Base Image
-    shell: bash
-    run: |
-      set -e
-
-      BASE_IMAGE="registry-nexus-bpkd.drc-bpkd.data-center.id/php74-fpm-oci8-lengkap:1.0"
-
-      echo "=========================================="
-      echo "PULL BASE IMAGE"
-      echo "=========================================="
-
-      echo "$BASE_IMAGE"
-
-      docker pull "$BASE_IMAGE"
-
-      echo ""
-      echo "Base image berhasil."
-
-      docker image inspect "$BASE_IMAGE" \
-        --format 'ID: {{.Id}}'
-
-  # ============================================================
-  # 6. Build SIDATA
-  # ============================================================
-  - name: Build Docker Image
-    shell: bash
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "BUILD SIDATA"
-      echo "=========================================="
-
-      docker build \
-        --build-arg http_proxy="$http_proxy" \
-        --build-arg https_proxy="$https_proxy" \
-        --build-arg HTTP_PROXY="$HTTP_PROXY" \
-        --build-arg HTTPS_PROXY="$HTTPS_PROXY" \
-        --build-arg no_proxy="$no_proxy" \
-        --build-arg NO_PROXY="$NO_PROXY" \
-        -t sidata:latest .
-
-      echo ""
-      echo "BUILD BERHASIL"
-
-      docker image inspect sidata:latest \
-        --format 'Image ID: {{.Id}}'
-
-  # ============================================================
-  # 7. Tag Image
-  # ============================================================
-  - name: Tag Image
-    shell: bash
-    env:
-      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-    run: |
-      set -e
-
-      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
-      IMAGE="${REGISTRY}/${REGISTRY_USER}/sidata"
-      SHA="${{ gitea.sha }}"
-
-      echo "=========================================="
-      echo "TAG IMAGE"
-      echo "=========================================="
-
-      docker tag sidata:latest "${IMAGE}:latest"
-      docker tag sidata:latest "${IMAGE}:${SHA}"
-
-      echo "Tagged:"
-      echo "${IMAGE}:latest"
-      echo "${IMAGE}:${SHA}"
-
-  # ============================================================
-  # 8. Push Image
-  # ============================================================
-  - name: Push Image
-    shell: bash
-    env:
-      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-    run: |
-      set -e
-
-      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
-      IMAGE="${REGISTRY}/${REGISTRY_USER}/sidata"
-      SHA="${{ gitea.sha }}"
-
-      echo "=========================================="
-      echo "PUSH IMAGE"
-      echo "=========================================="
-
-      docker push "${IMAGE}:latest"
-      docker push "${IMAGE}:${SHA}"
-
-      echo ""
-      echo "PUSH BERHASIL"
-
-  # ============================================================
-  # 9. Install kubectl
-  # ============================================================
-  - name: Install kubectl
-    shell: bash
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "INSTALL KUBECTL"
-      echo "=========================================="
-
-      KUBECTL_VERSION=$(curl -L -s \
-        --connect-timeout 10 \
-        https://dl.k8s.io/release/stable.txt)
-
-      echo "kubectl: ${KUBECTL_VERSION}"
-
-      curl -fL \
-        --connect-timeout 10 \
-        "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
-        -o kubectl
-
-      chmod +x kubectl
-
-      ./kubectl version --client
-
-  # ============================================================
-  # 10. Configure Rancher
-  # ============================================================
-  - name: Configure Rancher
-    shell: bash
-    env:
-      RANCHER_URL: ${{ secrets.RANCHER_URL }}
-      RANCHER_CLUSTER_ID: ${{ secrets.RANCHER_CLUSTER_ID }}
-      RANCHER_TOKEN: ${{ secrets.RANCHER_TOKEN }}
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "CONFIGURE RANCHER"
-      echo "=========================================="
-
-      if [ -z "$RANCHER_URL" ]; then
-        echo "ERROR: RANCHER_URL kosong."
-        exit 1
-      fi
-
-      if [ -z "$RANCHER_CLUSTER_ID" ]; then
-        echo "ERROR: RANCHER_CLUSTER_ID kosong."
-        exit 1
-      fi
-
-      if [ -z "$RANCHER_TOKEN" ]; then
-        echo "ERROR: RANCHER_TOKEN kosong."
-        exit 1
-      fi
-
-      ./kubectl config set-cluster rancher-cluster \
-        --server="${RANCHER_URL}/k8s/clusters/${RANCHER_CLUSTER_ID}" \
-        --insecure-skip-tls-verify=true
-
-      ./kubectl config set-credentials rancher-user \
-        --token="${RANCHER_TOKEN}"
-
-      ./kubectl config set-context rancher-context \
-        --cluster=rancher-cluster \
-        --user=rancher-user
-
-      ./kubectl config use-context rancher-context
-
-  # ============================================================
-  # 11. Test Rancher
-  # ============================================================
-  - name: Test Rancher Connection
-    shell: bash
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "RANCHER CONNECTION"
-      echo "=========================================="
-
-      ./kubectl cluster-info
-      ./kubectl get nodes
-
-  # ============================================================
-  # 12. Deploy Kubernetes
-  # ============================================================
-  - name: Deploy to Rancher
-    shell: bash
-    env:
-      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "DEPLOY SIDATA"
-      echo "=========================================="
-
-      if [ ! -d "k8s" ]; then
-        echo "ERROR: folder k8s/ tidak ditemukan."
-        exit 1
-      fi
-
-      ./kubectl apply -f k8s/
-
-      echo ""
-      echo "=========================================="
-      echo "STATUS"
-      echo "=========================================="
-
-      ./kubectl get deployments -A
-      ./kubectl get pods -A
-
-  # ============================================================
-  # 13. Rollout Status
-  # ============================================================
-  - name: Verify Deployment
-    shell: bash
-    run: |
-      set -e
-
-      echo "=========================================="
-      echo "VERIFY DEPLOYMENT"
-      echo "=========================================="
-
-      ./kubectl get deployment -A
-      ./kubectl get pods -A
-
-      echo ""
-      echo "SIDATA deployment selesai."
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Test Registry Secrets
+        shell: bash
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -e
+
+          echo "=========================================="
+          echo "TEST GITEA SECRETS"
+          echo "=========================================="
+
+          echo "REGISTRY_USER length: ${#REGISTRY_USER}"
+          echo "REGISTRY_PASSWORD length: ${#REGISTRY_PASSWORD}"
+
+          if [ -z "$REGISTRY_USER" ]; then
+            echo "ERROR: REGISTRY_USER TIDAK TERBACA"
+            exit 1
+          fi
+
+          if [ -z "$REGISTRY_PASSWORD" ]; then
+            echo "ERROR: REGISTRY_PASSWORD TIDAK TERBACA"
+            exit 1
+          fi
+
+          echo "SECRET BERHASIL TERBACA"
@@ -0,0 +1,376 @@
+name: CI/CD Pipeline to Rancher - SIDATA
+
+on:
+push:
+branches:
+- main
+
+jobs:
+build-and-deploy:
+runs-on: ubuntu-latest
+
+env:
+  # ============================================================
+  # Proxy
+  # ============================================================
+  HTTP_PROXY: http://10.15.3.20:80
+  HTTPS_PROXY: http://10.15.3.20:80
+  http_proxy: http://10.15.3.20:80
+  https_proxy: http://10.15.3.20:80
+
+  # ============================================================
+  # Internal network bypass proxy
+  # ============================================================
+  NO_PROXY: localhost,127.0.0.1,10.15.39.0/24,10.81.2.0/24,10.42.0.0/16,10.43.0.0/16,registry-nexus-bpkd.drc-bpkd.data-center.id,registry-bpkd.drc-bpkd.data-center.id,.drc-bpkd.data-center.id,.bpkd.jakarta.go.id
+
+  no_proxy: localhost,127.0.0.1,10.15.39.0/24,10.81.2.0/24,10.42.0.0/16,10.43.0.0/16,registry-nexus-bpkd.drc-bpkd.data-center.id,registry-bpkd.drc-bpkd.data-center.id,.drc-bpkd.data-center.id,.bpkd.jakarta.go.id
+
+steps:
+
+  # ============================================================
+  # 1. Check Container Engine
+  # ============================================================
+  - name: Check Container Engine
+    shell: bash
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "CONTAINER ENGINE"
+      echo "=========================================="
+
+      which docker
+      docker version
+
+      echo ""
+      echo "Docker socket:"
+      ls -l /var/run/docker.sock || true
+
+  # ============================================================
+  # 2. Check Registry Connectivity
+  # ============================================================
+  - name: Check Nexus Connectivity
+    shell: bash
+    run: |
+      set -e
+
+      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
+
+      echo "=========================================="
+      echo "CHECK NEXUS"
+      echo "=========================================="
+
+      echo "DNS:"
+      getent hosts "$REGISTRY"
+
+      echo ""
+      echo "Registry API:"
+
+      # HTTP 401 adalah NORMAL untuk registry private.
+      # Yang penting koneksi HTTPS berhasil.
+      HTTP_CODE=$(curl \
+        --silent \
+        --show-error \
+        --output /tmp/nexus-response.txt \
+        --write-out "%{http_code}" \
+        --connect-timeout 10 \
+        "https://${REGISTRY}/v2/" || true)
+
+      echo "HTTP status: ${HTTP_CODE}"
+
+      if [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "200" ]; then
+        echo "Nexus dapat diakses."
+      else
+        echo "ERROR: Nexus tidak dapat diakses."
+        cat /tmp/nexus-response.txt || true
+        exit 1
+      fi
+
+  # ============================================================
+  # 3. Check Registry Credentials
+  # ============================================================
+  - name: Check Registry Credentials
+    shell: bash
+    env:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "CHECK REGISTRY CREDENTIALS"
+      echo "=========================================="
+
+      echo "REGISTRY_USER length: ${#REGISTRY_USER}"
+      echo "REGISTRY_PASSWORD length: ${#REGISTRY_PASSWORD}"
+
+      if [ -z "$REGISTRY_USER" ]; then
+        echo "ERROR: REGISTRY_USER kosong."
+        echo "Periksa Repository -> Settings -> Actions -> Secrets."
+        exit 1
+      fi
+
+      if [ -z "$REGISTRY_PASSWORD" ]; then
+        echo "ERROR: REGISTRY_PASSWORD kosong."
+        echo "Periksa Repository -> Settings -> Actions -> Secrets."
+        exit 1
+      fi
+
+      echo "Registry credentials tersedia."
+
+  # ============================================================
+  # 4. Login Nexus
+  # ============================================================
+  - name: Login Nexus
+    shell: bash
+    env:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+      REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+    run: |
+      set -e
+
+      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
+
+      echo "=========================================="
+      echo "LOGIN NEXUS"
+      echo "=========================================="
+
+      printf '%s' "$REGISTRY_PASSWORD" | \
+        docker login "$REGISTRY" \
+          --username "$REGISTRY_USER" \
+          --password-stdin
+
+      echo "Login Nexus berhasil."
+
+  # ============================================================
+  # 5. Pull Base Image
+  # ============================================================
+  - name: Pull Base Image
+    shell: bash
+    run: |
+      set -e
+
+      BASE_IMAGE="registry-nexus-bpkd.drc-bpkd.data-center.id/php74-fpm-oci8-lengkap:1.0"
+
+      echo "=========================================="
+      echo "PULL BASE IMAGE"
+      echo "=========================================="
+
+      echo "$BASE_IMAGE"
+
+      docker pull "$BASE_IMAGE"
+
+      echo ""
+      echo "Base image berhasil."
+
+      docker image inspect "$BASE_IMAGE" \
+        --format 'ID: {{.Id}}'
+
+  # ============================================================
+  # 6. Build SIDATA
+  # ============================================================
+  - name: Build Docker Image
+    shell: bash
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "BUILD SIDATA"
+      echo "=========================================="
+
+      docker build \
+        --build-arg http_proxy="$http_proxy" \
+        --build-arg https_proxy="$https_proxy" \
+        --build-arg HTTP_PROXY="$HTTP_PROXY" \
+        --build-arg HTTPS_PROXY="$HTTPS_PROXY" \
+        --build-arg no_proxy="$no_proxy" \
+        --build-arg NO_PROXY="$NO_PROXY" \
+        -t sidata:latest .
+
+      echo ""
+      echo "BUILD BERHASIL"
+
+      docker image inspect sidata:latest \
+        --format 'Image ID: {{.Id}}'
+
+  # ============================================================
+  # 7. Tag Image
+  # ============================================================
+  - name: Tag Image
+    shell: bash
+    env:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+    run: |
+      set -e
+
+      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
+      IMAGE="${REGISTRY}/${REGISTRY_USER}/sidata"
+      SHA="${{ gitea.sha }}"
+
+      echo "=========================================="
+      echo "TAG IMAGE"
+      echo "=========================================="
+
+      docker tag sidata:latest "${IMAGE}:latest"
+      docker tag sidata:latest "${IMAGE}:${SHA}"
+
+      echo "Tagged:"
+      echo "${IMAGE}:latest"
+      echo "${IMAGE}:${SHA}"
+
+  # ============================================================
+  # 8. Push Image
+  # ============================================================
+  - name: Push Image
+    shell: bash
+    env:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+    run: |
+      set -e
+
+      REGISTRY="registry-nexus-bpkd.drc-bpkd.data-center.id"
+      IMAGE="${REGISTRY}/${REGISTRY_USER}/sidata"
+      SHA="${{ gitea.sha }}"
+
+      echo "=========================================="
+      echo "PUSH IMAGE"
+      echo "=========================================="
+
+      docker push "${IMAGE}:latest"
+      docker push "${IMAGE}:${SHA}"
+
+      echo ""
+      echo "PUSH BERHASIL"
+
+  # ============================================================
+  # 9. Install kubectl
+  # ============================================================
+  - name: Install kubectl
+    shell: bash
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "INSTALL KUBECTL"
+      echo "=========================================="
+
+      KUBECTL_VERSION=$(curl -L -s \
+        --connect-timeout 10 \
+        https://dl.k8s.io/release/stable.txt)
+
+      echo "kubectl: ${KUBECTL_VERSION}"
+
+      curl -fL \
+        --connect-timeout 10 \
+        "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+        -o kubectl
+
+      chmod +x kubectl
+
+      ./kubectl version --client
+
+  # ============================================================
+  # 10. Configure Rancher
+  # ============================================================
+  - name: Configure Rancher
+    shell: bash
+    env:
+      RANCHER_URL: ${{ secrets.RANCHER_URL }}
+      RANCHER_CLUSTER_ID: ${{ secrets.RANCHER_CLUSTER_ID }}
+      RANCHER_TOKEN: ${{ secrets.RANCHER_TOKEN }}
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "CONFIGURE RANCHER"
+      echo "=========================================="
+
+      if [ -z "$RANCHER_URL" ]; then
+        echo "ERROR: RANCHER_URL kosong."
+        exit 1
+      fi
+
+      if [ -z "$RANCHER_CLUSTER_ID" ]; then
+        echo "ERROR: RANCHER_CLUSTER_ID kosong."
+        exit 1
+      fi
+
+      if [ -z "$RANCHER_TOKEN" ]; then
+        echo "ERROR: RANCHER_TOKEN kosong."
+        exit 1
+      fi
+
+      ./kubectl config set-cluster rancher-cluster \
+        --server="${RANCHER_URL}/k8s/clusters/${RANCHER_CLUSTER_ID}" \
+        --insecure-skip-tls-verify=true
+
+      ./kubectl config set-credentials rancher-user \
+        --token="${RANCHER_TOKEN}"
+
+      ./kubectl config set-context rancher-context \
+        --cluster=rancher-cluster \
+        --user=rancher-user
+
+      ./kubectl config use-context rancher-context
+
+  # ============================================================
+  # 11. Test Rancher
+  # ============================================================
+  - name: Test Rancher Connection
+    shell: bash
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "RANCHER CONNECTION"
+      echo "=========================================="
+
+      ./kubectl cluster-info
+      ./kubectl get nodes
+
+  # ============================================================
+  # 12. Deploy Kubernetes
+  # ============================================================
+  - name: Deploy to Rancher
+    shell: bash
+    env:
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "DEPLOY SIDATA"
+      echo "=========================================="
+
+      if [ ! -d "k8s" ]; then
+        echo "ERROR: folder k8s/ tidak ditemukan."
+        exit 1
+      fi
+
+      ./kubectl apply -f k8s/
+
+      echo ""
+      echo "=========================================="
+      echo "STATUS"
+      echo "=========================================="
+
+      ./kubectl get deployments -A
+      ./kubectl get pods -A
+
+  # ============================================================
+  # 13. Rollout Status
+  # ============================================================
+  - name: Verify Deployment
+    shell: bash
+    run: |
+      set -e
+
+      echo "=========================================="
+      echo "VERIFY DEPLOYMENT"
+      echo "=========================================="
+
+      ./kubectl get deployment -A
+      ./kubectl get pods -A
+
+      echo ""
+      echo "SIDATA deployment selesai."