OpenClaw driving OpenCode to manage Gotham Stacks (k8s manifests)

openclaw-opencode-gotham-stacks.md

🔧 Gotham Stack Deployment Version Update

Use the opencode-coding-agent skill to work with the gotham-stacks repository on the opencode LXC.

Task:

1. SSH to LXC using: ssh -i /home/node/.openclaw/workspace/ssh-keys/opencode-lxc jason@10.1.2.8
2. Navigate to ~/projects/gotham-stacks on the LXC
3. Create a unique feature branch from the updated default branch (main/master):
   • Branch name format: feature/deployment-version-update-YYYY-MM-DD-HHMM
   • Example: feature/deployment-version-update-2026-04-09-1800 (6:00 PM run)
   • Example: feature/deployment-version-update-2026-04-09-0600 (6:00 AM run)
   • Must create a NEW branch each run (time-based naming ensures uniqueness)
4. Scan all k8s deployment manifest files for container image version updates
5. Process all deployments within each manifest file - find every image: field and check for updates
6. Process files one at a time to avoid excess context size - read, update, and stage each manifest individually
7. Update versions to latest verified available in the registry
8. Commit with: chore: update deployment container versions to latest verified -- Signed-off-by: Mads <openclaw>
9. Push the feature branch to GitHub
10. Create a pull request using gh CLI:
    • gh pr create --base main --head feature/deployment-version-update-YYYY-MM-DD-HHMM --title 'chore: update deployment container versions' --body 'Automated container version update from Gotham Stack cron job'

Rules:

• NEVER update deployments without explicit version tags
• NEVER commit to default/main branch - always use unique feature branches with date+time
• Include signature in every commit
• Each cron run must create a fresh branch (timestamp naming ensures uniqueness even for multiple daily runs)
• PR must be created for review before merging
• Prefer 'alpine' releases if present in the registry (e.g., image:xxx:1.2.3-alpine over image:xxx:1.2.3)
• Semantic version check only - only update if new version is HIGHER than current (e.g., 1.2.4 > 1.2.3, but 1.2.2 < 1.2.3)
• Do NOT downgrade versions - compare major.minor.patch numerically
• Skip images with 'docker' in the tag/name - do NOT download or update these (security risk)
• Ignore 'latest' tag - only use explicit semantic version tags (e.g., 1.2.3, not latest)
• VERIFY tag format BEFORE writing - validate the final tag matches X.Y.Z or X.Y.Z-suffix format (no 'v' prefix, valid semantic version). If tag has 'v' prefix, DO NOT use it - find the correct tag without 'v'
• Search registry for newest semantic version tag when updating
• Use Docker Hub tags API to find versions: https://hub.docker.com/r/<image-name>/tags?page_size=20&ordering=last_updated (use jq to parse JSON responses)
• Fallback URL if first fails: https://hub.docker.com/_/<image-name>/tags?page_size=20&ordering=last_updated (for official images)
• For GitHub-hosted images, use GitHub Releases API: https://api.github.com/repos/<owner>/<repo>/releases?per_page=10 (use jq to parse JSON responses)
• Ignore breaking versions - skip major version jumps that may introduce breaking changes (e.g., 1.x.x → 2.x.x requires manual review)
• Preserve tag metadata suffix - if current tag has no suffix (e.g., 1.2.3), don't add one (e.g., don't upgrade to 1.2.3-ubuntu); if current tag has -alpine, stay with -alpine variants only
• Process all deployments - find and update every image: field in each manifest file
• Process files one at a time - read, update, and stage each manifest individually to avoid context overflow

Use opencode --prompt \"Scan k8s deployment manifests in @media.yaml & @lab.yaml for container image version updates. Prefer 'alpine' tagged releases if available. Only update if new version is a higher semantic version (major.minor.patch) than current. IGNORE tags containing 'docker' and ignore 'latest' tag - only use explicit semantic version tags. VERIFY tag format BEFORE writing - validate final tag matches X.Y.Z or X.Y.Z-suffix regex pattern (no v prefix, valid semver). If tag has v prefix, DO NOT use it - find the correct tag without v. Use Docker Hub tags API (e.g., https://hub.docker.com/r/linuxserver/sonarr/tags?page_size=20&ordering=last_updated or https://hub.docker.com/_/redis/tags?page_size=20&ordering=last_updated for official images) with jq to parse JSON responses, sorted by latest first. For GitHub-hosted images, use GitHub Releases API (e.g., https://api.github.com/repos/openclaw/openclaw/releases?per_page=10) with jq to parse JSON. IGNORE breaking versions (major version jumps like 1.x.x → 2.x.x require manual review). PRESERVE tag metadata suffix - if current tag has no suffix (e.g., 1.2.3), don't add one (e.g., don't upgrade to 1.2.3-ubuntu); if current tag has -alpine, stay with -alpine variants only. Process ALL deployments within each manifest file - find every image: field and check for updates. Process files one at a time to avoid excess context size. Create feature branch with today's date and current time (YYYY-MM-DD-HHMM format), commit with signature, push to GitHub, and create a pull request using gh CLI.\" mode for this task. SSH key is at /home/node/.openclaw/workspace/ssh-keys/opencode-lxc. Model selection is handled by opencode config.