2026-06-12 — demarkus-library deploy manifests + CI/release

Roadmap item 1 (deploy manifests), branch feature/deploy-manifests, awaiting Fritz commit/PR.

Shipped (working tree)

• .goreleaser.yml (root): single-module → plain v tags, NO monorepo block (unlike demarkus). Used archives.ids not archives.builds — deprecated since goreleaser 2.8 (demarkus repo still on old syntax; goreleaser check fails locally on it). Added var version = "dev" to main.go for the -X main.version ldflag.
• Dockerfile (root): COPY-only over dist/docker/<arch>/ staged binaries (no QEMU compile), distroless/static-debian12:nonroot — CA certs needed for outbound HTTPS to broker. EXPOSE 8080/tcp.
• deploy/helm/demarkus-library/: mirrors broker chart conventions. Key divergences:
  • replicaCount: 1 + strategy: Recreate — sessions in-memory; rolling update = login flapping. PDB default-off (minAvailable 1 would block drains at 1 replica).
  • Env-based config (no config.yaml Secret like broker). Chart-managed -oauth Secret only for cleartext library.broker.clientSecret; existingSecretRef mode for production. checksum/secret annotation only in cleartext mode.
  • demarkus-library.validate helper mirrors NewAppConfig startup validation at render time (transport enum, broker-mode required fields, secret mutual exclusion, quic host).
  • NetworkPolicy egress: DNS + TCP 443 (broker) + UDP 6309 (networkPolicy.quicEgressPort, federation/quic dials).
  • Probes both hit /health (only endpoint; broker has /healthz+/readyz).
  • automountServiceAccountToken: false (library never talks to kube-apiserver, unlike broker).
  • 23 helm-unittest tests (deployment/secret/ingress suites) pass.
• .github/workflows/ci.yml: paths-filter (app/charts), golangci-lint v2.9.0 action, go test/vet/build, goreleaser check, helm lint+unittest.
• .github/workflows/release.yml: test → semver (PaulHatch, tag_prefix v, no change_path — single module, chart-only commits must bump too) → tag + goreleaser-pro + stage binaries + buildx multi-arch (amd64/arm64/armv7) → ghcr.io/latebit-io/demarkus-library + helm chart to oci://ghcr.io/latebit-io/charts, version==appVersion==image tag.
• Lint cleanup: 13 errcheck issues fixed with explicit _ = discards (demarkus convention) in broker.go, oauth.go, 2 test files. Default golangci-lint now 0 issues.

Deferred / decisions

• demarkus's strict .golangci.yml (gocritic/revive/gocyclo/modernize) NOT adopted — 18 issues would need fixing (mostly gocritic style in tests). CI uses lint defaults.
• Repo secret needed before first release: GORELEASER_KEY (goreleaser pro). GITHUB_TOKEN covers ghcr.
• Verified locally: go test ✓, golangci-lint 0 issues ✓, goreleaser check ✓, snapshot build + version stamp ✓, helm lint ✓, helm template (7 resources) ✓, 23 unittest ✓.

Next

• Fritz: commit, PR, add GORELEASER_KEY secret.
• Roadmap item 2: drop broker rateLimit.tokens to ~30/min burst ~15 (demarkus repo AppSet values).
• Then rendering upgrades (chroma first).

Correction: GORELEASER_KEY is an org-level (global) secret — already available to this repo, no per-repo setup needed.