fix(ci): evaluate short SHA in bash step and include flux-system in root kustomization (#47)

### Summary of Changes

- Evaluated `short_sha` inside a bash step (`id: vars`) so Docker
`build-args` receives the expanded short SHA (e.g. `sha-4429a65`) rather
than literal bash code strings.
- Added `- flux-system` to
`ci/k8s/clusters/production/kustomization.yaml` to prevent Flux from
pruning its own `GitRepository` resource during reconciliation.

.github/workflows/services-docs-next-required.yml

@@ -81,6 +81,10 @@ jobs:
             type=raw,value=latest
             type=sha,format=short
 
+      - name: Compute short SHA
+        id: vars
+        run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:
@@ -90,8 +94,8 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            COMMIT_SHA=sha-$(echo ${{ github.sha }} | cut -c1-7)
-            VERSION=sha-$(echo ${{ github.sha }} | cut -c1-7)
+            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+            VERSION=${{ steps.vars.outputs.short_sha }}
 
   deploy:
     name: Deploy - Kubernetes (GitOps)

.github/workflows/services-www-next-required.yml

@@ -357,6 +357,10 @@ jobs:
             type=raw,value=next
             type=sha,format=short
 
+      - name: Compute short SHA
+        id: vars
+        run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:
@@ -366,5 +370,5 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            COMMIT_SHA=sha-$(echo ${{ github.sha }} | cut -c1-7)
-            VERSION=sha-$(echo ${{ github.sha }} | cut -c1-7)
+            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
+            VERSION=${{ steps.vars.outputs.short_sha }}

.github/workflows/services-www-releases-dispatch-release.yml

@@ -265,9 +265,11 @@ jobs:
           # Extract MAJOR.MINOR for tagging
           MAJOR_MINOR=$(echo "${{ github.ref_name }}" | cut -d/ -f3 | sed 's/^v//')
           MAJOR=$(echo "$MAJOR_MINOR" | cut -d. -f1)
+          SHORT_SHA="sha-$(echo ${{ github.sha }} | cut -c1-7)"
           echo "version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
           echo "major_minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
           echo "major=$MAJOR" >> $GITHUB_OUTPUT
+          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
 
       - name: Create and Push Tag
         run: |
@@ -303,7 +305,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            COMMIT_SHA=sha-$(echo ${{ github.sha }} | cut -c1-7)
+            COMMIT_SHA=${{ steps.version.outputs.short_sha }}
             VERSION=v${{ steps.version.outputs.version }}
 
   deploy:

ci/k8s/clusters/production/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - flux-system
   - ../../base/namespaces
   - ../../infrastructure/cert-manager
   - ../../infrastructure/networking