ship: OCI images, helm chart, :ship version train (I8) #17

Merged

PerishFire merged 1 commit from i8-ship into main

2026-07-19 03:06:11 +00:00

PerishFire commented

2026-07-19 03:01:07 +00:00

Owner

No description provided.

PerishFire added 1 commit

2026-07-19 03:01:07 +00:00

ship: OCI images, helm chart, :ship version train (I8)

guard / guard (pull_request) Successful in 4m54s

Details

9a77a06762

The delivery apex — first real image+chart in the fleet.
- deploy/: multi-stage api (rust release, cargo creds via BuildKit
  secret) + web (vite dist behind nginx replicating the method-split
  proxy) Dockerfiles + a compose that runs api+web+pg. Verified end-to-
  end through the production images (login → portal renders, session
  round-trips) — screenshots, not just a build.
- charts/ensign: api+web Deployments/Services, ingress, bundled PG
  (external-ref override), a persistent vault for the OIDC signing key,
  and a post-install genesis Job that captures keel's minted sudo token
  from the api logs into a Secret (RBAC scoped). helm lint + template
  clean; conditionals (bundled/external pg, ingress on/off) verified.
- :ship builds+pushes both images and packages+pushes the chart on one
  version train from clean main. helm lint joins guard.

SEAM (keel follow-up, not blocking): keel bind() only prints the sudo
token to stderr; automating the genesis Secret cleanly wants bind() to
RETURN it, so the Job greps a (stable) keel log line for now.

The helm install onto a cluster is the user's manual gate (spec I8).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PerishFire merged commit 41012a1107 into main

2026-07-19 03:06:11 +00:00

PerishFire deleted branch i8-ship

2026-07-19 03:06:11 +00:00

PerishFire referenced this pull request from a commit

2026-07-19 03:06:11 +00:00

ship: OCI images, helm chart, :ship version train (I8) (#17)