Scope rule engine rollout permissions

.gitea/workflows/publish.yaml

@@ -19,6 +19,16 @@ jobs:
           token: ${{ secrets.GITEA_TOKEN }}
           persist-credentials: true
 
+      - name: Check release credentials before changing the version
+        shell: bash
+        env:
+          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
+          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
+        run: |
+          set -euo pipefail
+          test -n "$HARBOR_USERNAME" || { echo 'Missing HARBOR_USERNAME action secret'; exit 1; }
+          test -n "$HARBOR_PASSWORD" || { echo 'Missing HARBOR_PASSWORD action secret'; exit 1; }
+
       - name: Test and lint in the shared builder image
         shell: bash
         run: |
@@ -115,8 +125,11 @@ jobs:
             echo 'NATS is not installed yet. The backend release pipeline bootstraps NATS and this Argo Application.'
             exit 0
           fi
+          if ! kubectl -n argocd get application ai-spel-rule-engine >/dev/null 2>&1; then
+            echo 'The backend release pipeline owns first-time Argo Application creation; skipping this worker-only rollout.'
+            exit 0
+          fi
           kubectl -n ai-spel rollout status statefulset/ai-spel-nats --timeout=10m
-          kubectl -n argocd apply -f deploy/argocd/application.yaml
           kubectl -n argocd patch application ai-spel-rule-engine --type merge -p "{\"spec\":{\"source\":{\"targetRevision\":\"$version\"}}}"
           deadline=$((SECONDS + 600))
           while (( SECONDS < deadline )); do