Address PR review: error handling, DX, cleanup

- Remove workflow test changes from images.yaml
- Remove --dry-run from provisioners (use y-cluster-converge-ystack directly)
- Remove kubie null workaround from qemu teardown
- Use absolute paths for yconverge calls (no cd to YSTACK_HOME)
- y-image-list-ystack: let kustomize errors propagate
- kubectl-yconverge: replace grep -c with wc -l, guard file existence
  in _find_imports, use || : for legitimate empty-string fallbacks
- y-cluster-converge-ystack: use absolute paths in _resolve_target

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Yolean k8s-qa

.github/workflows/images.yaml

@@ -4,40 +4,12 @@ on:
   push:
     branches:
     - main
-    - y-converge-checks-dag
 
 jobs:
-  checks:
-    uses: ./.github/workflows/checks.yaml
-  y-kustomize:
-    needs: checks
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
-      with:
-        go-version: '1.26'
-    - name: Login to GitHub Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-    - name: Build Go binary
-      working-directory: y-kustomize/cmd
-      run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags='-s -w' -o target/linux/amd64/y-kustomize .
-    - name: Build and push image
-      working-directory: y-kustomize/cmd
-      env:
-        YSTACK_HOME: ${{ github.workspace }}
-        PATH: ${{ github.workspace }}/bin:/usr/local/bin:/usr/bin:/bin
-      run: |
-        IMAGE=ghcr.io/yolean/y-kustomize:${{ github.sha }} \
-          y-contain build --push
+  lint:
+    uses: ./.github/workflows/lint.yaml
   docker:
-    needs: checks
+    needs: lint
     runs-on: ubuntu-latest
     permissions:
       packages: write

bin/kubectl-yconverge

@@ -148,10 +148,11 @@ _find_cue_dirs() {
 _DEP_VISITED=""
 
 _find_imports() {
-  grep '"yolean.se/ystack/' "$1" 2>/dev/null \
+  [ -f "$1" ] || return 0
+  grep '"yolean.se/ystack/' "$1" \
     | grep -v '"yolean.se/ystack/yconverge/verify"' \
     | sed 's|.*"yolean.se/ystack/\([^":]*\).*|\1|' \
-    || true # y-script-lint:disable=or-true # no imports is valid
+    || :
 }
 
 _resolve_deps() {
@@ -182,14 +183,14 @@ ${1%/}"
 
 if [ -z "$_YCONVERGE_RESOLVING" ] && [ -n "$KUSTOMIZE_DIR" ]; then
   deps=$(_resolve_deps "$KUSTOMIZE_DIR")
-  dep_count=$(printf '%s\n' "$deps" | grep -c . 2>/dev/null) || true # y-script-lint:disable=or-true # grep -c . exit 1 = zero matches
+  dep_count=$(printf '%s\n' "$deps" | wc -l)
 
   if [ "$MODE" = "print-deps" ]; then
     printf '%s\n' "$deps"
     exit 0
   fi
 
-  if [ "$dep_count" -gt 1 ] 2>/dev/null; then
+  if [ "$dep_count" -gt 1 ]; then
     echo "=== Converge plan (context=$CONTEXT, mode=$MODE) ==="
     echo "Steps ($dep_count):"
     for d in $deps; do echo "  $d"; done
@@ -237,7 +238,7 @@ if [ -z "$NS_GUESS" ] && [ -n "$KUSTOMIZE_DIR" ]; then
   NS_GUESS=$(y-kustomize-traverse -q -o namespace "$KUSTOMIZE_DIR")
 fi
 if [ -z "$NS_GUESS" ]; then
-  NS_GUESS=$(kubectl config view --minify --context="$CONTEXT" -o jsonpath='{.contexts[0].context.namespace}' 2>/dev/null) || true # y-script-lint:disable=or-true # context may not exist in kubeconfig
+  NS_GUESS=$(kubectl config view --minify --context="$CONTEXT" -o jsonpath='{.contexts[0].context.namespace}' 2>/dev/null) || :
 fi
 [ -z "$NS_GUESS" ] && NS_GUESS="default"
 export NAMESPACE="$NS_GUESS"

bin/y-cluster-converge-ystack

@@ -37,12 +37,10 @@ done
 
 export OVERRIDE_IP
 
-cd "$YSTACK_HOME"
-
 _resolve_target() {
-  for d in k3s/*/; do
-    local base="${d#k3s/}"        # strip k3s/ prefix
-    base="${base%%/}"             # strip trailing /
+  for d in "$YSTACK_HOME"/k3s/*/; do
+    local base="${d%/}"
+    base="${base##*/}"            # strip path prefix
     base="${base#[0-9][0-9]-}"   # strip number prefix (e.g. 40-)
     if [ "$base" = "$1" ]; then
       echo "$d"

bin/y-cluster-provision-k3d

@@ -15,7 +15,6 @@ K3D_DOCKER_UPDATE="--cpuset-cpus=3 --cpus=3"
 SKIP_CONVERGE=false
 SKIP_IMAGE_LOAD=false
 CONVERGE_TARGETS="y-kustomize,blobs,builds-registry"
-DRY_RUN=""
 
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -32,7 +31,6 @@ Flags:
   --converge=LIST       comma-separated k3s bases to converge (default: y-kustomize,blobs,builds-registry)
   --skip-converge       skip converge, validate, and post-provision steps
   --skip-image-load     skip image cache and load into containerd
-  --dry-run=MODE        forward to kubectl-yconverge (server|none)
   --teardown            delete existing cluster and exit
   -h, --help            show this help
 EOF
@@ -45,7 +43,6 @@ EOF
     --converge=*) CONVERGE_TARGETS="${1#*=}"; shift ;;
     --skip-converge) SKIP_CONVERGE=true; shift ;;
     --skip-image-load) SKIP_IMAGE_LOAD=true; shift ;;
-    --dry-run=*) DRY_RUN="$1"; shift ;;
     --teardown) TEARDOWN=true; shift ;;
     *) echo "Unknown flag: $1" >&2; exit 1 ;;
   esac
@@ -124,8 +121,8 @@ until kubectl --context=$CTX get nodes >/dev/null 2>&1; do sleep 2; done
 
 # Gateway API is always set up, even with --skip-converge.
 export OVERRIDE_IP=${YSTACK_PORTS_IP:-127.0.0.1}
-(cd "$YSTACK_HOME" && kubectl-yconverge --context=$CTX -k k3s/10-gateway-api/)
-(cd "$YSTACK_HOME" && kubectl-yconverge --context=$CTX -k k3s/20-gateway/)
+kubectl yconverge --context=$CTX -k "$YSTACK_HOME/k3s/10-gateway-api/"
+kubectl yconverge --context=$CTX -k "$YSTACK_HOME/k3s/20-gateway/"
 
 if [ "$SKIP_CONVERGE" = "true" ]; then
   echo "# --skip-converge: skipping converge, validate, and post-provision steps"
@@ -142,7 +139,7 @@ else
   y-image-cache-load-all </dev/null || true
 fi
 
-y-cluster-converge-ystack --context=$CTX --converge=$CONVERGE_TARGETS $DRY_RUN --override-ip=${YSTACK_PORTS_IP:-127.0.0.1}
+y-cluster-converge-ystack --context=$CTX --converge=$CONVERGE_TARGETS --override-ip=${YSTACK_PORTS_IP:-127.0.0.1}
 
 # Registry resolution uses magic ClusterIPs in registries.yaml — no /etc/hosts needed.
 # TODO: add containerd registry access verification (like qemu provisioner)

bin/y-cluster-provision-qemu

@@ -16,7 +16,6 @@ VM_SSH_PORT="2222"
 SKIP_CONVERGE=false
 SKIP_IMAGE_LOAD=false
 CONVERGE_TARGETS="y-kustomize,blobs,builds-registry"
-DRY_RUN=""
 
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -37,7 +36,6 @@ Flags:
   --converge=LIST         comma-separated k3s bases to converge (default: y-kustomize,blobs,builds-registry)
   --skip-converge         skip converge and post-provision steps
   --skip-image-load       skip image cache and load into containerd
-  --dry-run=MODE          forward to kubectl-yconverge (server|none)
   --teardown              stop and delete the VM (removes disk by default)
   --keep-disk             preserve disk image on teardown for faster re-provision
   --export-vmdk=PATH      export disk as streamOptimized VMDK
@@ -55,7 +53,6 @@ EOF
     --converge=*) CONVERGE_TARGETS="${1#*=}"; shift ;;
     --skip-converge) SKIP_CONVERGE=true; shift ;;
     --skip-image-load) SKIP_IMAGE_LOAD=true; shift ;;
-    --dry-run=*) DRY_RUN="$1"; shift ;;
     --teardown) TEARDOWN=true; shift ;;
     --keep-disk) KEEP_DISK=true; shift ;;
     --export-vmdk=*) EXPORT_VMDK="${1#*=}"; shift ;;
@@ -127,10 +124,6 @@ if [ "$TEARDOWN" = "true" ]; then
     rm -f "$VM_DISK"
     echo "[y-cluster-provision-qemu] Teardown complete. Disk deleted."
   fi
-  # Fix kubectl writing null instead of [] when last item is removed
-  sed -i 's/^contexts: null$/contexts: []/' "$KUBECONFIG" 2>/dev/null
-  sed -i 's/^clusters: null$/clusters: []/' "$KUBECONFIG" 2>/dev/null
-  sed -i 's/^users: null$/users: []/' "$KUBECONFIG" 2>/dev/null
   exit 0
 fi
 
@@ -252,8 +245,8 @@ y-kubeconfig-import "$KUBECONFIG.tmp"
 # Gateway API is always set up, even with --skip-converge.
 # Services are reachable via port-forward at 127.0.0.1.
 export OVERRIDE_IP=127.0.0.1
-(cd "$YSTACK_HOME" && kubectl-yconverge --context=$CTX -k k3s/10-gateway-api/)
-(cd "$YSTACK_HOME" && kubectl-yconverge --context=$CTX -k k3s/20-gateway/)
+kubectl yconverge --context=$CTX -k "$YSTACK_HOME/k3s/10-gateway-api/"
+kubectl yconverge --context=$CTX -k "$YSTACK_HOME/k3s/20-gateway/"
 
 if [ "$SKIP_CONVERGE" = "true" ]; then
   echo "[y-cluster-provision-qemu] --skip-converge: done"
@@ -270,7 +263,7 @@ fi
 
 # Converge ystack infrastructure (includes Gateway API and /etc/hosts via y-k8s-ingress-hosts)
 # Use 127.0.0.1 as override IP since services are reachable via port-forward
-y-cluster-converge-ystack --context=$CTX --converge=$CONVERGE_TARGETS $DRY_RUN --override-ip=127.0.0.1
+y-cluster-converge-ystack --context=$CTX --converge=$CONVERGE_TARGETS --override-ip=127.0.0.1
 
 # Verify containerd can reach registries via mirror config (magic ClusterIPs)
 echo "[y-cluster-provision-qemu] Verifying containerd registry access ..."

bin/y-image-list-ystack

@@ -20,10 +20,9 @@ for target in $(echo "$CONVERGE_TARGETS" | tr ',' ' '); do
     base="${base##*/}"
     base="${base#[0-9][0-9]-}"
     [ "$base" = "$target" ] || continue
-    kubectl kustomize "$d" 2>/dev/null \
+    kubectl kustomize "$d" \
       | grep -oE 'image:\s*\S+' \
-      | sed 's/image:[[:space:]]*//' \
-      || true # y-script-lint:disable=or-true # kustomize may fail for bases requiring y-kustomize HTTP
+      | sed 's/image:[[:space:]]*//'
     break
   done
 done | sort -u