# 2026-06-12 — demarkus-library deploy manifests + CI/release

Roadmap item 1 (deploy manifests), branch `feature/deploy-manifests`, awaiting Fritz commit/PR.

## Shipped (working tree)

- **`.goreleaser.yml`** (root): single-module → plain `v` tags, NO monorepo block (unlike demarkus). Used `archives.ids` not `archives.builds` — deprecated since goreleaser 2.8 (demarkus repo still on old syntax; `goreleaser check` fails locally on it). Added `var version = "dev"` to main.go for the `-X main.version` ldflag.
- **`Dockerfile`** (root): COPY-only over `dist/docker/<arch>/` staged binaries (no QEMU compile), `distroless/static-debian12:nonroot` — CA certs needed for outbound HTTPS to broker. EXPOSE 8080/tcp.
- **`deploy/helm/demarkus-library/`**: mirrors broker chart conventions. Key divergences:
  - `replicaCount: 1` + `strategy: Recreate` — sessions in-memory; rolling update = login flapping. PDB default-off (minAvailable 1 would block drains at 1 replica).
  - Env-based config (no config.yaml Secret like broker). Chart-managed `-oauth` Secret only for cleartext `library.broker.clientSecret`; `existingSecretRef` mode for production. `checksum/secret` annotation only in cleartext mode.
  - `demarkus-library.validate` helper mirrors NewAppConfig startup validation at render time (transport enum, broker-mode required fields, secret mutual exclusion, quic host).
  - NetworkPolicy egress: DNS + TCP 443 (broker) + UDP 6309 (`networkPolicy.quicEgressPort`, federation/quic dials).
  - Probes both hit `/health` (only endpoint; broker has /healthz+/readyz).
  - `automountServiceAccountToken: false` (library never talks to kube-apiserver, unlike broker).
  - 23 helm-unittest tests (deployment/secret/ingress suites) pass.
- **`.github/workflows/ci.yml`**: paths-filter (app/charts), golangci-lint v2.9.0 action, go test/vet/build, goreleaser check, helm lint+unittest.
- **`.github/workflows/release.yml`**: test → semver (PaulHatch, tag_prefix `v`, no change_path — single module, chart-only commits must bump too) → tag + goreleaser-pro + stage binaries + buildx multi-arch (amd64/arm64/armv7) → ghcr.io/latebit-io/demarkus-library + helm chart to oci://ghcr.io/latebit-io/charts, version==appVersion==image tag.
- **Lint cleanup**: 13 errcheck issues fixed with explicit `_ =` discards (demarkus convention) in broker.go, oauth.go, 2 test files. Default golangci-lint now 0 issues.

## Deferred / decisions

- demarkus's strict `.golangci.yml` (gocritic/revive/gocyclo/modernize) NOT adopted — 18 issues would need fixing (mostly gocritic style in tests). CI uses lint defaults.
- Repo secret needed before first release: `GORELEASER_KEY` (goreleaser pro). `GITHUB_TOKEN` covers ghcr.
- Verified locally: go test ✓, golangci-lint 0 issues ✓, goreleaser check ✓, snapshot build + version stamp ✓, helm lint ✓, helm template (7 resources) ✓, 23 unittest ✓.

## Next

- Fritz: commit, PR, add GORELEASER_KEY secret.
- Roadmap item 2: drop broker rateLimit.tokens to ~30/min burst ~15 (demarkus repo AppSet values).
- Then rendering upgrades (chroma first).

**Correction:** `GORELEASER_KEY` is an org-level (global) secret — already available to this repo, no per-repo setup needed.

## Module-path migration to latebit-io (later same day)

demarkus merged the rename (`15cc18b` fix(package): latebit → latebit-io, tags
client/v0.12.40 + protocol/v0.7.13, proxy-resolvable — verified). Library
follow-up (working tree on top of 712511f "feat(CI): added deploy manifests"):

- Imports rewritten `github.com/latebit/demarkus/` → `latebit-io`; go.mod
  replaces DROPPED, now requires client v0.12.40 + protocol v0.7.13 (tagged,
  fetchable — no sibling checkout needed anywhere).
- Library's own module renamed too: `module github.com/latebit-io/demarkus-library`
  (same latent mismatch; `go mod edit -module` + import sweep). Gotcha:
  renaming internal imports before the module line makes `go mod tidy` fetch
  the repo from the proxy as an external dep — fix module line first.
- CI/release sibling-clone steps removed from both workflows.
- Verified: build ✓, tests ✓, lint 0 ✓, vet ✓, goreleaser check + snapshot ✓.

The 2026-06-12 sibling-clone entry in debugging.md is now historical.

## PR #10 review response (CodeRabbit, 11 findings — all addressed)

Workflows: actions pinned to commit SHAs (tag comments kept) · ci.yml top-level
`permissions: contents: read` · release.yml write scopes moved to release job
only · non-cancelling `concurrency: release-${ref}` (semver/tag race) ·
release test job now also runs helm lint+unittest (chart-only push can't ship
broken chart) · `if: failure()` rollback step deletes release+tag so a failed
publish doesn't burn the version (tag must still exist BEFORE goreleaser —
GORELEASER_CURRENT_TAG).

Chart: validate helper trims all presence checks (matches NewAppConfig trim;
whitespace-only fails at render not CrashLoop) + new `cleartextSecret` helper
shared by secret.yaml/deployment.yaml · `automountServiceAccountToken: false`
on POD spec (held SA-only before; broke when serviceAccount.create=false) ·
NetworkPolicy ingress adds same-namespace `podSelector: {}` (default install
was unreachable — ingress.enabled defaults false) · NOTES insecure warning
gated on `quic OR federation` — NOT the reviewer's exact ask (move under quic
branch): DEMARKUS_INSECURE also governs broker-mode federation QUIC dials, so
quic-branch-only would hide a real warning.

Code: session_test.go setup Save now t.Fatalf on error.

24 chart tests (added whitespace-trim regression), lint 0, go tests pass.