# canvas-ops-actuator

Single-purpose workflow runner for fixing `canvas.flow-master.ai`.

The Gitea Actions workflow at `.gitea/workflows/canvas-find-and-patch.yml`
runs on the `build01` runner (cluster kubectl access via ServiceAccount)
and:

1. Finds the Ingress / Traefik IngressRoute claiming `canvas.flow-master.ai`
2. Traces backend Service → Deployment
3. Captures pre-patch Deployment YAML as an artifact
4. `kubectl set image` + `rollout restart` to the new canvas-frontend tag
5. Verifies `/api/ea2/work-items` returns 401 (not 502)

`workflow_dispatch` only — never auto-runs. Trigger via the Gitea Actions tab.

Context: `FM06/flowmaster-ops#1176`, `FM06/flowmaster-ops#1178` (blocked by
`.gitea/workflows/**` branch protection on ops).