# 2026-06-12 — demarkus-library deploy manifests + CI/release

Roadmap item 1 (deploy manifests), branch `feature/deploy-manifests`, awaiting Fritz commit/PR.

## Shipped (working tree)

- **`.goreleaser.yml`** (root): single-module → plain `v` tags, NO monorepo block (unlike demarkus). Used `archives.ids` not `archives.builds` — deprecated since goreleaser 2.8 (demarkus repo still on old syntax; `goreleaser check` fails locally on it). Added `var version = "dev"` to main.go for the `-X main.version` ldflag.
- **`Dockerfile`** (root): COPY-only over `dist/docker/<arch>/` staged binaries (no QEMU compile), `distroless/static-debian12:nonroot` — CA certs needed for outbound HTTPS to broker. EXPOSE 8080/tcp.
- **`deploy/helm/demarkus-library/`**: mirrors broker chart conventions. Key divergences:
  - `replicaCount: 1` + `strategy: Recreate` — sessions in-memory; rolling update = login flapping. PDB default-off (minAvailable 1 would block drains at 1 replica).
  - Env-based config (no config.yaml Secret like broker). Chart-managed `-oauth` Secret only for cleartext `library.broker.clientSecret`; `existingSecretRef` mode for production. `checksum/secret` annotation only in cleartext mode.
  - `demarkus-library.validate` helper mirrors NewAppConfig startup validation at render time (transport enum, broker-mode required fields, secret mutual exclusion, quic host).
  - NetworkPolicy egress: DNS + TCP 443 (broker) + UDP 6309 (`networkPolicy.quicEgressPort`, federation/quic dials).
  - Probes both hit `/health` (only endpoint; broker has /healthz+/readyz).
  - `automountServiceAccountToken: false` (library never talks to kube-apiserver, unlike broker).
  - 23 helm-unittest tests (deployment/secret/ingress suites) pass.
- **`.github/workflows/ci.yml`**: paths-filter (app/charts), golangci-lint v2.9.0 action, go test/vet/build, goreleaser check, helm lint+unittest.
- **`.github/workflows/release.yml`**: test → semver (PaulHatch, tag_prefix `v`, no change_path — single module, chart-only commits must bump too) → tag + goreleaser-pro + stage binaries + buildx multi-arch (amd64/arm64/armv7) → ghcr.io/latebit-io/demarkus-library + helm chart to oci://ghcr.io/latebit-io/charts, version==appVersion==image tag.
- **Lint cleanup**: 13 errcheck issues fixed with explicit `_ =` discards (demarkus convention) in broker.go, oauth.go, 2 test files. Default golangci-lint now 0 issues.

## Deferred / decisions

- demarkus's strict `.golangci.yml` (gocritic/revive/gocyclo/modernize) NOT adopted — 18 issues would need fixing (mostly gocritic style in tests). CI uses lint defaults.
- Repo secret needed before first release: `GORELEASER_KEY` (goreleaser pro). `GITHUB_TOKEN` covers ghcr.
- Verified locally: go test ✓, golangci-lint 0 issues ✓, goreleaser check ✓, snapshot build + version stamp ✓, helm lint ✓, helm template (7 resources) ✓, 23 unittest ✓.

## Next

- Fritz: commit, PR, add GORELEASER_KEY secret.
- Roadmap item 2: drop broker rateLimit.tokens to ~30/min burst ~15 (demarkus repo AppSet values).
- Then rendering upgrades (chroma first).