Fix Kubernetes Label Validation Error for Parent Stack Values

.github/actions/cancel-stack/action.yml

@@ -71,7 +71,7 @@ outputs:
 
 runs:
   using: 'docker'
-  image: 'docker://simplecontainer/github-actions:latest'
+  image: 'docker://simplecontainer/github-actions:staging'
   env:
     GITHUB_ACTION_TYPE: 'cancel-stack'
     STACK_NAME: ${{ inputs.stack-name }}

.github/actions/deploy-client-stack/action.yml

@@ -69,7 +69,7 @@ outputs:
 
 runs:
   using: 'docker'
-  image: 'docker://simplecontainer/github-actions:latest'
+  image: 'docker://simplecontainer/github-actions:staging'
   env:
     GITHUB_ACTION_TYPE: 'deploy-client-stack'
     STACK_NAME: ${{ inputs.stack-name }}

.github/actions/destroy/action.yml

@@ -72,7 +72,7 @@ outputs:
 
 runs:
   using: 'docker'
-  image: 'docker://simplecontainer/github-actions:latest'
+  image: 'docker://simplecontainer/github-actions:staging'
   env:
     GITHUB_ACTION_TYPE: 'destroy'
     STACK_NAME: ${{ inputs.stack-name }}

.github/actions/provision-parent-stack/action.yml

@@ -62,7 +62,7 @@ outputs:
 
 runs:
   using: 'docker'
-  image: 'docker://simplecontainer/github-actions:latest'
+  image: 'docker://simplecontainer/github-actions:staging'
   env:
     GITHUB_ACTION_TYPE: 'provision-parent-stack'
     STACK_NAME: ${{ inputs.stack-name }}

.github/workflows/branch.yaml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   build:
     name: Build simple-container in branch
-    runs-on: blacksmith-32vcpu-ubuntu-2204
+    runs-on: blacksmith-8vcpu-ubuntu-2204
     outputs:
       cicd-bot-telegram-token: ${{ steps.prepare-secrets.outputs.cicd-bot-telegram-token }}
       cicd-bot-telegram-chat-id: ${{ steps.prepare-secrets.outputs.cicd-bot-telegram-chat-id }}

.github/workflows/build-staging.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   build-staging:
     name: Build Staging Image
-    runs-on: blacksmith-32vcpu-ubuntu-2204
+    runs-on: blacksmith-8vcpu-ubuntu-2204
     outputs:
       cicd-bot-telegram-token: ${{ steps.prepare-additional-secrets.outputs.cicd-bot-telegram-token }}
       cicd-bot-telegram-chat-id: ${{ steps.prepare-additional-secrets.outputs.cicd-bot-telegram-chat-id }}
@@ -104,13 +104,31 @@ jobs:
             --push \
             .
 
+      - name: Build and push caddy staging image
+        env:
+          DOCKER_BUILDKIT: 1
+        run: |
+          # Build and push caddy staging image with BuildKit caching
+          # Tag with both 'staging' and the full VERSION (e.g., staging-219-20260220-093856)
+          docker buildx build \
+            --platform linux/amd64 \
+            --cache-from type=gha \
+            --cache-to type=gha,mode=max \
+            --file caddy.Dockerfile \
+            --tag simplecontainer/caddy:staging \
+            --tag simplecontainer/caddy:$VERSION \
+            --push \
+            .
+
       - name: Image built successfully
         run: |
-          echo "🎉 GitHub Actions staging image built successfully with BuildKit + GitHub Actions caching!"
+          echo "🎉 GitHub Actions and Caddy staging images built successfully with BuildKit + GitHub Actions caching!"
           echo ""
-          echo "🚀 The staging image is now available:"
-          echo "   simplecontainer/github-actions:staging" 
+          echo "🚀 The staging images are now available:"
+          echo "   simplecontainer/github-actions:staging"
           echo "   simplecontainer/github-actions:${{ github.ref_name }}"
+          echo "   simplecontainer/caddy:staging"
+          echo "   simplecontainer/caddy:$VERSION"
           echo ""
           echo "📦 Built with version: $VERSION"
           echo "✅ Your GitHub Actions will now use the updated staging image with your latest changes!"

.github/workflows/push.yaml

@@ -31,15 +31,15 @@ jobs:
 
   build:
     name: Build and release simple-container
-    runs-on: blacksmith-32vcpu-ubuntu-2204
+    runs-on: blacksmith-8vcpu-ubuntu-2204
     needs: prepare
     outputs:
       cicd-bot-telegram-token: ${{ steps.prepare-secrets.outputs.cicd-bot-telegram-token }}
       cicd-bot-telegram-chat-id: ${{ steps.prepare-secrets.outputs.cicd-bot-telegram-chat-id }}
     steps:
       - uses: actions/checkout@v4
       - uses: fregante/setup-git-user@v2
-      - name: install sc tool (latest release) 
+      - name: install sc tool (latest release)
         shell: bash
         run: |-
           # Install latest SC release to get secrets for embeddings generation
@@ -53,7 +53,7 @@ jobs:
           ${{ secrets.SC_CONFIG }}
           EOF
           sc secrets reveal
-      - name: get openai key 
+      - name: get openai key
         id: get-openai-key
         run: |
           echo "openai-key=$(sc stack secret-get -s dist openai-api-key 2>/dev/null || echo '')" >> $GITHUB_OUTPUT

cmd/github-actions/main.go

@@ -293,6 +293,19 @@ func initializeSubmodules(ctx context.Context, log logger.Logger, workDir, token
 
 	log.Info(ctx, "Git submodules detected - initializing and updating...")
 
+	// Fix for "detected dubious ownership" error - add workDir to safe.directory
+	safeDirCmd := []string{"git", "config", "--global", "--add", "safe.directory", workDir}
+	if err := runGitCommand(ctx, log, workDir, safeDirCmd); err != nil {
+		log.Debug(ctx, "Failed to add safe.directory config: %v", err)
+		// Continue anyway - this is best-effort
+	}
+
+	// Also add wildcard to cover any nested submodule directories
+	wildcardCmd := []string{"git", "config", "--global", "--add", "safe.directory", "*"}
+	if err := runGitCommand(ctx, log, workDir, wildcardCmd); err != nil {
+		log.Debug(ctx, "Failed to add wildcard safe.directory: %v", err)
+	}
+
 	// Configure submodules to use the authenticated URL
 	// This ensures submodules use the same token for authentication
 	submoduleUpdateCmd := []string{
@@ -336,7 +349,16 @@ func runGitCommandWithAuth(ctx context.Context, log logger.Logger, dir string, a
 		cmd.Dir = dir
 		cmd.Env = env
 		if output, err := cmd.CombinedOutput(); err != nil {
-			log.Debug(ctx, "Failed to configure submodule URL rewrite: %s", string(output))
+			log.Debug(ctx, "Failed to configure submodule URL rewrite (HTTPS): %s", string(output))
+			// Continue anyway - this is a best-effort configuration
+		}
+
+		// Also rewrite SSH URLs (git@github.com:) to use HTTPS with token
+		cmd = exec.Command("git", "config", "--local", "url."+submoduleConfig+".insteadOf", "git@github.com:")
+		cmd.Dir = dir
+		cmd.Env = env
+		if output, err := cmd.CombinedOutput(); err != nil {
+			log.Debug(ctx, "Failed to configure submodule URL rewrite (SSH): %s", string(output))
 			// Continue anyway - this is a best-effort configuration
 		}
 	}

pkg/clouds/pulumi/kubernetes/simple_container.go

@@ -64,6 +64,30 @@ func sanitizeK8sResourceName(name string) string {
 	return sanitized
 }
 
+// sanitizeK8sLabelValue sanitizes a value to be valid for Kubernetes labels
+// Kubernetes label values must be empty or consist of alphanumeric characters, '-', '_' or '.',
+// and must start and end with an alphanumeric character
+func sanitizeK8sLabelValue(value string) string {
+	if value == "" {
+		return value
+	}
+
+	// Replace forward slashes with hyphens (common in stack paths like "/demo/root")
+	sanitized := strings.ReplaceAll(value, "/", "-")
+	// Replace other invalid characters with hyphens
+	reg := regexp.MustCompile(`[^a-zA-Z0-9\-_\.]`)
+	sanitized = reg.ReplaceAllString(sanitized, "-")
+	// Remove leading/trailing hyphens, underscores, or dots to ensure alphanumeric start/end
+	sanitized = strings.Trim(sanitized, "-_.")
+
+	// If the result is empty after sanitization, provide a default
+	if sanitized == "" {
+		sanitized = "unknown"
+	}
+
+	return sanitized
+}
+
 type SimpleContainerArgs struct {
 	// required properties
 	Namespace              string  `json:"namespace" yaml:"namespace"`
@@ -146,18 +170,18 @@ func NewSimpleContainer(ctx *sdk.Context, args *SimpleContainerArgs, opts ...sdk
 
 	// Add parentEnv labels for custom stacks
 	if args.ParentEnv != nil && lo.FromPtr(args.ParentEnv) != "" && lo.FromPtr(args.ParentEnv) != args.ScEnv {
-		appLabels[LabelParentEnv] = lo.FromPtr(args.ParentEnv)
+		appLabels[LabelParentEnv] = sanitizeK8sLabelValue(lo.FromPtr(args.ParentEnv))
 		appLabels[LabelCustomStack] = "true"
 	}
 
 	// Add parent-stack and client-stack labels if provided
 	if args.ParentStack != nil && *args.ParentStack != "" {
-		appLabels[LabelParentStack] = *args.ParentStack
+		appLabels[LabelParentStack] = sanitizeK8sLabelValue(*args.ParentStack)
 	}
 	// Note: client-stack is typically same as parent-stack in nested scenarios
 	// but can be different in more complex hierarchies
 	if args.ParentStack != nil && *args.ParentStack != "" {
-		appLabels[LabelClientStack] = *args.ParentStack
+		appLabels[LabelClientStack] = sanitizeK8sLabelValue(*args.ParentStack)
 	}
 
 	appAnnotations := map[string]string{