Add Docker image and Helm chart publishing#3
Merged
Conversation
- deploy/Dockerfile: multi-stage Go build (1.24.2-alpine), non-root user, port 8080 - charts/version-guard/: Helm chart (Deployment, Service, ServiceAccount) with env-var config - .github/workflows/docker.yml: PR builds (single-arch + chart lint), main push (multi-arch to GHCR), v* tag (publish chart to OCI registry) - Makefile: updated docker-build to use deploy/Dockerfile Amp-Thread-ID: https://ampcode.com/threads/T-019d73dd-3cfe-773a-898f-7f7efbb7eb68 Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019d73dd-3cfe-773a-898f-7f7efbb7eb68 Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019d73dd-3cfe-773a-898f-7f7efbb7eb68 Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019d73dd-3cfe-773a-898f-7f7efbb7eb68 Co-authored-by: Amp <amp@ampcode.com>
- Fix YAML indentation in test.yml (broken linter step) - Add explicit permissions to lint-chart job - Add semver tag without v-prefix to match Chart.yaml appVersion - Use yq instead of grep/awk for Chart.yaml parsing - Add container-level securityContext (readOnlyRootFilesystem, drop ALL caps) - Extract containerPort to values.yaml for consistency - Add gRPC liveness and readiness probes - Use BuildKit cache mounts in Dockerfile for faster builds Amp-Thread-ID: https://ampcode.com/threads/T-019d794b-a1d1-7425-b8a6-f519f6c68b53 Co-authored-by: Amp <amp@ampcode.com>
- Add top-level permissions: {} for least-privilege default
- Pass secrets/context vars via env: blocks instead of inline interpolation
- Switch gRPC probes to tcpSocket (server lacks grpc.health.v1.Health)
- Add seccompProfile: RuntimeDefault for restricted PSS compliance
Amp-Thread-ID: https://ampcode.com/threads/T-019d794b-a1d1-7425-b8a6-f519f6c68b53
Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019d794b-a1d1-7425-b8a6-f519f6c68b53 Co-authored-by: Amp <amp@ampcode.com>
Kiran01bm
approved these changes
Apr 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds CI for building/publishing the Docker image and a Helm chart for deploying Version Guard to Kubernetes.
Workflow: Docker & Helm (
.github/workflows/docker.yml)ct lint+ version bump checkghcr.io/block/version-guard:latestand:<sha>v*)ghcr.io/block/version-guard:v1.0.0and:1.0oci://ghcr.io/block/charts/version-guard:1.0.0PR builds are single-platform for fast feedback (~2 min vs ~16 min with multi-arch).
Versioning
Chart.yamlis the source of truth for bothversion(chart version) andappVersion(Docker image tag default). Both are committed in the repo and bumped in PRs before tagging a release.Release flow:
versionandappVersioninChart.yamlgit tag v0.2.0 && git push origin v0.2.0Helm chart (
charts/version-guard/)A generic chart for deploying Version Guard to Kubernetes. All runtime config is via environment variables (matching the existing
.env.examplepattern). Configurable viaenv,extraVolumes, and resource limits.Usage:
Dockerfile (
deploy/Dockerfile)Multi-stage build:
golang:1.24.2-alpine→alpine:3.21. Non-root user (uid 1000), read-only root filesystem, port 8080 (gRPC).🤖 Generated with Amp