From 4bc823f9852f406edb95af11d9772d80c35e32d8 Mon Sep 17 00:00:00 2001
From: Derek Roberts <derek.roberts@gmail.com>
Date: Thu, 3 Sep 2026 01:00:42 -0700
Subject: [PATCH] fix(ci): create init Secret and NetworkPolicies once

Postgres only honors POSTGRES_PASSWORD on empty PGDATA. oc apply of the
database Secret on every merge desynced Flyway (28P01). NetworkPolicy
specs are stable; new names still oc create.
---
 .github/workflows/reusable-deploy.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/reusable-deploy.yml b/.github/workflows/reusable-deploy.yml
index 8de32f3d9..9514f26be 100644
--- a/.github/workflows/reusable-deploy.yml
+++ b/.github/workflows/reusable-deploy.yml
@@ -55,7 +55,10 @@ jobs:
           oc_namespace: ${{ secrets.oc_namespace }}
           oc_server: ${{ vars.oc_server }}
           oc_token: ${{ secrets.oc_token }}
-          overwrite: true
+          # Secret + NetworkPolicies: create if missing. Postgres ignores
+          # POSTGRES_PASSWORD after first boot; restamping the Secret desyncs Flyway.
+          # New NetworkPolicy names still apply; existing NP specs do not update.
+          overwrite: false
           parameters: -p DB_PASSWORD="$DB_PASSWORD"
             -p ZONE="${{ inputs.target }}"
             -p NAME="${{ github.event.repository.name }}"