feat: add kustomize setup and pin image version in deployment

.github/workflows/deploy.yml

@@ -119,8 +119,18 @@ jobs:
 
           KUBECONFIG="${KUBECONFIG_PATH}" kubectl cluster-info --request-timeout=15s
 
+      - name: Set up kustomize
+        env:
+          KUSTOMIZE_VERSION: v5.7.1
+        run: |
+          mkdir -p "${RUNNER_TEMP}/bin"
+          curl -fsSL "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz" \
+            | tar -xz -C "${RUNNER_TEMP}/bin" kustomize
+          echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
+
       - name: Pin image to this commit
-        run: sed -i "s/newTag: latest/newTag: sha-${GITHUB_SHA}/" k8s/kustomization.yaml
+        working-directory: k8s
+        run: kustomize edit set image "jesseinit-portfolio=${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA}"
 
       - name: Apply manifests
         run: kubectl apply -k k8s/

k8s/kustomization.yaml

@@ -15,7 +15,7 @@ labels:
       app.kubernetes.io/name: personal-site
       app.kubernetes.io/managed-by: kustomize
 
-# CI rewrites newTag to sha-<commit> before applying.
+# CI pins this to sha-<commit> with `kustomize edit set image` before applying.
 images:
   - name: jesseinit-portfolio
     newName: tea.jesseinit.dev/jesseinit/personal-site