fix: skip gates and health checks on first deploy

internal/controller/rollout_controller.go

@@ -102,7 +102,7 @@
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.
 func (r *RolloutReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	log := logf.FromContext(ctx)
 
 	rollout := rolloutv1alpha1.Rollout{}
@@ -195,7 +195,7 @@
 				// Check if user has requested to unblock failed deployment via annotation
 				unblockRequested := false
 				if rollout.Annotations != nil {
 					if unblock, exists := rollout.Annotations["rollout.kuberik.com/unblock-failed"]; exists && unblock == "true" {
 						unblockRequested = true
 						log.Info("User requested to unblock failed deployment via annotation")
 					}
@@ -218,7 +218,8 @@
 	}
 
 	// Gating logic: gates already evaluated at the beginning, check if deployment should be blocked
-	if !r.hasManualDeployment(&rollout) {
+	// Skip gate blocking on first deploy (empty history) so a rollout always reaches its initial version.
+	if !r.hasManualDeployment(&rollout) && len(rollout.Status.History) > 0 {
 		if !gatesPassing {
 			return ctrl.Result{}, nil // Status already updated at the beginning
 		}
@@ -227,9 +228,15 @@
 		}
 	}
 
+	// On first deploy, fall back to raw release candidates if gates filtered them all out.
+	if len(rollout.Status.History) == 0 && len(gatedReleaseCandidates) == 0 {
+		gatedReleaseCandidates = releaseCandidates
+	}
+
 	// Evaluate health checks - block deployment if health checks are not healthy
 	// For manual deployments (WantedVersion or force-deploy), skip this check
-	if !r.hasManualDeployment(&rollout) {
+	// Also skip when no version has been deployed yet (first deploy) — nothing is running so health checks will be unhealthy by definition
+	if !r.hasManualDeployment(&rollout) && len(rollout.Status.History) > 0 {
 		healthChecksHealthy, healthCheckMessage, err := r.evaluateHealthChecks(ctx, req.Namespace, &rollout)
 		if err != nil {
 			log.Error(err, "Failed to evaluate health checks")
@@ -480,7 +487,7 @@
 }
 
 // parseOCIManifest extracts all metadata from OCI image manifest including version, revision, artifact type, source, title, and description.
 func (r *RolloutReconciler) parseOCIManifest(ctx context.Context, imageRef string, imagePolicy *imagev1beta2.ImagePolicy) (version, revision, artifactType, source, title, description *string, created *metav1.Time, err error) {
 	log := logf.FromContext(ctx)
 
 	// Get authentication keychain from ImageRepository
@@ -719,7 +726,7 @@
 }
 
 // evaluateGates lists and evaluates gates, updates rollout status, and returns filtered candidates and gatesPassing.
 func (r *RolloutReconciler) evaluateGates(ctx context.Context, namespace string, rollout *rolloutv1alpha1.Rollout, releaseCandidates []rolloutv1alpha1.VersionInfo) ([]rolloutv1alpha1.VersionInfo, bool, error) {
 	// Check for gate bypass annotation
 	bypassVersion := ""
 	if rollout.Annotations != nil {
@@ -1071,7 +1078,7 @@
 }
 
 // deployRelease finds and patches Flux resources with the wanted version.
 func (r *RolloutReconciler) deployRelease(ctx context.Context, rollout *rolloutv1alpha1.Rollout, wantedRelease string) error {
 	log := logf.FromContext(ctx)
 
 	// Check if this deployment was done with gate bypass
@@ -1579,7 +1586,7 @@
 	return nil
 }
 
 func (r *RolloutReconciler) handleBakeTime(ctx context.Context, namespace string, rollout *rolloutv1alpha1.Rollout) (ctrl.Result, error) {
 	log := logf.FromContext(ctx)
 	now := r.now()