From 74203073f4de57c710b4e2615521c262454b740c Mon Sep 17 00:00:00 2001
From: Lint Roller <23+gb_lint@noreply.git.farh.net>
Date: Sun, 9 Aug 2026 11:17:17 +0000
Subject: [PATCH] docs(qa): catalog base64-corrupted infra YAML defect pattern
 (GRO-2699)

---
 ... Corrupted to Single-Line Base64 Blob.-.md | 29 +++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 Defect Pattern%3A Infra YAML Corrupted to Single-Line Base64 Blob.-.md

diff --git a/Defect Pattern%3A Infra YAML Corrupted to Single-Line Base64 Blob.-.md b/Defect Pattern%3A Infra YAML Corrupted to Single-Line Base64 Blob.-.md
new file mode 100644
index 0000000..0e0f4ed
--- /dev/null
+++ b/Defect Pattern%3A Infra YAML Corrupted to Single-Line Base64 Blob.-.md	
@@ -0,0 +1,29 @@
+# Defect Pattern: Infra YAML Corrupted to Single-Line Base64 Blob
+
+**Owner:** QA (Lint Roller) · **First cataloged:** GRO-2699 (infra PR #732) · Previously seen on a corrupted `ci.yml`.
+
+## Symptom
+
+A `groombook/infra` PR that should be a trivial edit (e.g. an image tag bump) shows a huge `deletions` count and `additions: 1` per file. The diff replaces the entire original YAML with a **single line of base64 text**, ending with `\ No newline at end of file`. The base64, when decoded, is the *correct intended YAML* — so the change looks right at a glance and the PR body reads normally.
+
+## Why it's dangerous
+
+- The file **content on disk is literally the base64 string**, not YAML. `kustomize build` parses it as a single scalar, not a Kustomization → **Flux fails to reconcile the entire overlay**, not just the intended change. On a prod overlay this can wedge prod GitOps.
+- A reviewer skimming the *rendered* diff may mentally decode the base64 and approve the correct-looking intent, missing that the on-disk bytes are broken.
+
+## Detection (do this on every infra PR)
+
+1. **Trust CI red.** The infra `CI / ci` YAML-lint step fails (exit 1) on the corrupted files. Never wave a red infra PR through.
+2. **Confirm the raw bytes** via the Gitea contents API — decode **once**:
+   - Healthy: decodes to `apiVersion: kustomize...` (real YAML).
+   - Corrupted: decodes to *another* base64 string (e.g. `YXBpVmVyc2lvbjog...`).
+3. Watch for the diff shape: single `+` line + `\ No newline at end of file` + a deletion count matching the whole original file.
+
+## Fix
+
+Re-commit each affected file as **plain YAML text** (the decoded content), then confirm CI is green. Fast local self-check: `kustomize build apps/overlays/<env>`.
+
+## Related
+
+- QA defect-pattern catalog: see also *dev-uat Promotion Clobbers Env-Specific Overlay State* and *kubeconform CI Flake*.
+- Root cause is a tooling/serialization slip on the author side (a file written base64-encoded instead of decoded), not a logic bug — so the *intent* is usually correct; only the encoding is wrong.