CI gates the Helm chart: k8s-lint plus a compose↔chart drift check #168

New Issue

2026-09-10T08:59:05Z

not commented

2026-09-10 08:59:05 +00:00

Outcome: .gitea/workflows/ci.yaml runs make k8s-lint, and a new make k8s-drift fails when infra/docker-compose.yml and infra/helm/big-reference stop describing the same stack.

ADR-0033 shipped the chart with two named costs: "a second deployment description to keep in step with compose — nothing enforces that today; a drift check belongs in CI (follow-up)", and make k8s-lint existing but never being run by CI. So a values typo or an upstream image bump applied to only one of the two files lands unnoticed.

Scope:

A k8s job in CI that installs a pinned Helm and runs the chart checks. No cluster needed.
make k8s-drift: compare the rendered chart against docker compose config — workload names and resolved container images — with the deviations ADR-0033 forced (the four folded *-init services, the two chart-only bootstrap Jobs) declared explicitly, so a new difference is what fails.

Definition of Done

A linked Gitea issue exists (this one).
Failing test written and committed first.
Implementation makes the test pass.
Conventional Commit messages referencing this issue (refs #NN).
All Gitea Actions CI jobs green.
Docs touched if behaviour, contracts, or operations changed.
ADR added in docs/architecture/ if a non-obvious decision was made.
This issue closed by the merging PR (closes #NN).

**Outcome:** `.gitea/workflows/ci.yaml` runs `make k8s-lint`, and a new `make k8s-drift` fails when `infra/docker-compose.yml` and `infra/helm/big-reference` stop describing the same stack. ADR-0033 shipped the chart with two named costs: *"a second deployment description to keep in step with compose — nothing enforces that today; a drift check belongs in CI (follow-up)"*, and `make k8s-lint` existing but never being run by CI. So a values typo or an upstream image bump applied to only one of the two files lands unnoticed. Scope: - A `k8s` job in CI that installs a pinned Helm and runs the chart checks. No cluster needed. - `make k8s-drift`: compare the rendered chart against `docker compose config` — workload names and resolved container images — with the deviations ADR-0033 forced (the four folded `*-init` services, the two chart-only bootstrap Jobs) declared explicitly, so a *new* difference is what fails. ## Definition of Done - [ ] A linked Gitea issue exists (this one). - [ ] Failing test written and committed first. - [ ] Implementation makes the test pass. - [ ] Conventional Commit messages referencing this issue (`refs #NN`). - [ ] All Gitea Actions CI jobs green. - [ ] Docs touched if behaviour, contracts, or operations changed. - [ ] ADR added in `docs/architecture/` if a non-obvious decision was made. - [ ] This issue closed by the merging PR (`closes #NN`).

not added this to the Iteration 6 — Production Posture milestone 2026-09-10 08:59:05 +00:00

not added the type:chore area:infra labels 2026-09-10 08:59:05 +00:00

not referenced a pull request that will close this issue

2026-09-10 09:01:57 +00:00

ci(k8s): gate the Helm chart in CI + a compose↔chart drift check (closes #168) #171