DevOps hardening (CI, images, Helm, self-metrics) + console pages

[Mehulsri07]

Summary

A DevOps pass over the CI pipeline, container images, Helm chart and observability (commit 36aa73b). The branch also carries an earlier frontend commit (190e683, "Updates"): new console pages (Dashboard, Audit Log, Docs, Product), their data modules, and the .kiro specs.

Defects fixed

• Migrations never re-ran on helm upgrade. The migrate Job had a fixed name, so an unchanged spec was skipped and a changed image tag failed on the immutable pod template. The Job name now carries the release revision.
• Postgres-marked tests were excluded from CI, although Postgres is the store backend everywhere. They use testcontainers, so they now run in the test job; only Kafka stays excluded.
• .dockerignore did not exclude node_modules, so local builds copied host node_modules over the ones installed in the image.
• Images were mutable and never published. CI now pushes base, full and console images to GHCR tagged with the git SHA on each master commit that passes the smoke test.

Other changes

• CI: lint and test run in parallel; superseded runs cancel; compose images build with a layer cache; new helm lint/template job; advisory pip-audit, npm audit and Trivy jobs; default read-only permissions and timeouts; dependabot.yml.
• Containers: all images run as non-root (uid 10001, console on nginx-unprivileged); uv and Prometheus pinned; shared sources stage in deploy/Dockerfile; compose healthcheck moved into the service anchor; Postgres/Redis ports bound to 127.0.0.1.
• Helm: resources and securityContext on the platform services; Redis as a StatefulSet with AOF on a PVC, probes and maxmemory; namespaced Role by default with a ClusterRole only when rbac.sandbox=true; postgres.existingSecret.
• Observability: platform services expose request count and latency at /_metrics (auth-exempt, labelled by route template), scraped by Prometheus in compose and k8s. The path is not /metrics because read and feedback already serve token-gated JSON there.

Reviewer notes

• Not verified locally: image builds, the Helm templates and the Postgres tests (no Docker daemon or Helm on the authoring machine). This PR's CI run is their first execution. Lint and the non-Postgres suite pass locally (709 passed).
• Security scans are advisory. The Meridian UI lockfile already has 5 high-severity npm audit findings, so the audit and Trivy jobs do not block yet; each is a one-line change to make blocking.
• The publish job needs packages: write for GITHUB_TOKEN on this repository and only runs on pushes to master.

Upgrade notes

• Existing compose rca-context volumes are root-owned; run docker compose down -v once after pulling (this also resets the local Postgres volume).
• helm upgrade replaces the Redis Deployment with a StatefulSet.
• A release using SANDBOX_MODE=k8s must also set rbac.sandbox=true.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 34281b4c-a363-4830-8e0b-ecdc0d99fa78

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}