Improve k8s deployment setup

We now use the sha explicitly rather than the confusing GH var (I think
this is just set to 'prod' anyway) and we actively listen for the
deployment to complete.

Author: pimterry

.github/workflows/ci.yml

@@ -165,18 +165,20 @@ jobs:
 
       - name: Deploy to Kubernetes
         run: |
-          sed "s|/website:latest|/website:${{ vars.DOCKER_IMAGE_TAG }}|g" deploy/deployment.yaml | \
+          sed "s|/website:latest|/website:sha-${GITHUB_SHA::7}|g" deploy/deployment.yaml | \
             kubectl apply -f - \
               -f deploy/service.yaml \
               -f deploy/routes.yaml
 
+          kubectl rollout status deployment/httptoolkit-website -n httptoolkit-website
+
       - name: Redeploy container
         uses: httptoolkit/deploy-scaleway-serverless-container-action@v1
         with:
           container_id: ${{ vars.SCW_API_CONTAINER_ID }}
           region: ${{ vars.SCW_API_CONTAINER_REGION }}
           secret_key: ${{ secrets.SCW_SECRET_KEY }}
-          registry_image_url: "registry.hub.docker.com/httptoolkit/website:${{ vars.DOCKER_IMAGE_TAG }}"
+          registry_image_url: "registry.hub.docker.com/httptoolkit/website:sha-${GITHUB_SHA::7}"
 
       - name: Redeploy failover container
         uses: httptoolkit/deploy-scaleway-serverless-container-action@v1
@@ -185,7 +187,7 @@ jobs:
           container_id: ${{ vars.SCW_FAILOVER_API_CONTAINER_ID }}
           region: ${{ vars.SCW_FAILOVER_API_CONTAINER_REGION }}
           secret_key: ${{ secrets.SCW_SECRET_KEY }}
-          registry_image_url: "registry.hub.docker.com/httptoolkit/website:${{ vars.DOCKER_IMAGE_TAG }}"
+          registry_image_url: "registry.hub.docker.com/httptoolkit/website:sha-${GITHUB_SHA::7}"
 
       - name: Flush CDN cache
         if: ${{ vars.BUNNY_PULL_ZONE_ID }}