[chriswydra]

Artifactory was switched off on 2026-09-11 (DEVENV-9852). k8s-promote.yml still fetched the build index from artifactory.../docker-build-metadata/<app>/builds/<id>/index.json and exit 1s when it cannot, so every promotion now fails.

What changed (.github/workflows/k8s-promote.yml)

• The "Fetch build metadata" step now installs oras (same pin as docker-build.yml) and pulls the build index from Harbor as an OCI artifact: <harbor_host>/<harbor_builds_project>/<app_name>:<build_id>. That is exactly what docker-build.yml pushes (builds/<image_name>:<build_id>, layers outputs.json + bake-metadata.json) and what k8s-apps-config bin/update-app-manifest.sh and tak-nonprod-swarm-a lib/harbor.js already read. outputs.json is copied to build-index.json, so the downstream steps (which only use .outputs[].target and .digest) are unchanged.
• image_registry is now the Harbor path <harbor_host>/<image_namespace>/<app> - no Artifactory /docker/ segment.
• New inputs, all defaulted: harbor_host (registry.landcareresearch.co.nz), harbor_username (robot account name), harbor_builds_project (builds), runs_on (ubuntu-latest, mirroring docker-build.yml).
• Secrets: ARTIFACTORY_HOST / ARTIFACTORY_TOKEN removed; HARBOR_TOKEN (required) added. Unavoidable - the workflow had no Harbor credential at all. The only in-org caller is this repo's README example, which is updated.
• docker-build.yml and its ARTIFACTORY_* inputs are untouched (separate cleanup).

Verification (against a real build, not a synthetic one)

• oras pull of registry.landcareresearch.co.nz/builds/nsdr-editor:245-8ca0d576ea26a174960ff79447f920b58f00844a with a Harbor user: artifact type application/vnd.landcareresearch.build-index+json, layers outputs.json (1186 B) and bake-metadata.json (2142 B). The same fetch also works as a raw registry v2 call (401 -> /service/token with scope repository:builds/nsdr-editor:pull -> manifest 200 -> blob 200), which is what oras does under the hood.
• Ran the new fetch step's shell verbatim locally (echo token | oras pull -u ... --password-stdin ... -o build-index, then the outputs.json guard) - succeeds; then ran the unchanged "Generate promotion manifest" jq over the pulled index - produces the expected components / images structure with .target = web and the image digest.
• Workflow parses as YAML and the CI yq required-field checks (inputs.environment, inputs.build_id) still pass.

Things for the reviewer to decide

• Harbor is internal-only (no external route to registry.landcareresearch.co.nz), so a promotion on the default ubuntu-latest runner cannot fetch anything. I kept the default for parity with docker-build.yml and documented it; flipping the default to the self-hosted label (tak-k8s-ci) may be the better call.
• app_name must match the image_name the build pushed under (both default to the repository name) - unchanged behaviour, now spelled out in a comment.
• The pre-existing full_ref convention (<registry>/<app>/<target>) suits GitHub bake layouts; a Bitbucket-built single-target app (the nsdr-editor index records mwlr-private/nsdr-editor:<tag>) does not fit it. Out of scope here, noting it because it showed up while testing.