update

[firefart]

No description provided.

[Copilot]

🟡 Changes recommended

The Helm CronJob template changes introduce configuration/runtime inconsistencies (notably msmtp config path alignment and missing stateful volume mounts) that can break mail/cron behavior in Kubernetes deployments.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the repository’s security and deployment scaffolding, with a particular focus on making the Helm chart more release-scoped/production-safe (naming, Secrets, NetworkPolicy defaults) and tightening version pinning and CI validation.

Changes:

• Add a SECURITY.md policy and expand Kubernetes/Helm operational guidance in Readme.md.
• Refactor the Helm chart to use release-scoped resource names, split mail config into a Secret, add a dedicated mailgate Service, and enable NetworkPolicy by default.
• Pin several “latest” image/tool references (Compose images, Dockerfile uv + getmail6) and add a repository validation workflow (Helm lint/template + kubeconform + ShellCheck + Compose config validation).

File summaries

File	Description
SECURITY.md	Adds a vulnerability reporting and supported-versions policy.
Readme.md	Updates Helm/Kubernetes instructions for release-scoped Secrets and operational notes (mail + PVC keep policy).
k8s-jobs/install-ingress.sh	Makes ingress-nginx install idempotent and adds strict bash flags.
k8s-jobs/db-update.yaml	Hardens job execution (backoff/deadline/token mount) and updates names/tags to release-scoped defaults.
k8s-jobs/db-init.yaml	Same as db-update: hardening + release-scoped resource names/tags.
helm/values.yaml	Introduces override knobs, config-renderer settings, mail Secret values, enables NetworkPolicy by default, and refactors RT config blocks.
helm/templates/serviceaccount.yaml	Uses helper-driven ServiceAccount naming.
helm/templates/service-rt.yaml	Renames caddy Service via helpers and separates mailgate exposure (mailgate port removed here).
helm/templates/service-postgres.yaml	Renames postgres Service via helpers.
helm/templates/service-mailgate.yaml	Adds a dedicated Service for the mailgate port.
helm/templates/secret-mail.yaml	Adds a Secret for msmtp/getmailrc (chart-managed unless an existing Secret is specified).
helm/templates/secret-db.yaml	Renames DB credentials Secret to a release-scoped helper name.
helm/templates/route.yaml	Updates Route naming and targets the helper-based caddy Service name.
helm/templates/pvc.yaml	Release-scopes PVC names and adds Helm keep policy annotations.
helm/templates/pvc-postgres.yaml	Makes postgres PVC optional via values and applies keep policy + release-scoped name.
helm/templates/pdb.yaml	Release-scopes PodDisruptionBudget name.
helm/templates/NOTES.txt	Simplifies notes output and adds local port-forward instructions + PVC keep-policy reminder.
helm/templates/networkpolicy.yaml	Release-scopes NetworkPolicy name (policy behavior unchanged).
helm/templates/jobs.yaml	Refactors CronJobs to generate config via gomplate and consume mail/db Secrets with release-scoped naming.
helm/templates/ingress.yaml	Release-scopes Ingress name and targets helper-based caddy Service name.
helm/templates/hpa-rt.yaml	Release-scopes HPA and scaleTargetRef names.
helm/templates/deployment-rt.yaml	Switches to helper-based naming, adds config-renderer usage, and refactors Secret/volume wiring.
helm/templates/deployment-postgres.yaml	Switches to helper-based naming and makes postgres-data volume optionally PVC/emptyDir.
helm/templates/configmap.yaml	Renames config ConfigMap and limits it to RT site config + caddyfile (mail moved to Secret).
helm/templates/_helpers.tpl	Adds name/fullname helpers and derived helper names (caddy, db, mailgate, Secrets, config).
helm/Chart.yaml	Bumps chart version to 0.3.0.
Dockerfile	Pins uv image and pins getmail6 tool version for reproducible builds.
docker-compose.yml	Pins RT image default via env var, parameterizes replica count, and pins caddy tag.
docker-compose.dev.yml	Pins postgres and pgadmin image tags.
dev-helm.sh	Makes dev Helm setup namespace/release configurable and adds rollout/job waits.
CLAUDE.md	Updates documented perl base image versions to 5.44.0.
AGENTS.md	Adds repository guidelines document (largely mirroring existing guidance).
.goreleaser.yaml	Removes unused GoReleaser config template.
.gitignore	Stops ignoring all *.sh/*.pm and narrows JSON ignore to a specific local Claude settings file.
.github/workflows/yamllint.yml	Replaces third-party yamllint action with pipx-installed yamllint invocation.
.github/workflows/validate.yml	Adds a validation workflow (ShellCheck, Helm lint/template, kubeconform, Compose model validation).

Review details

• Files reviewed: 35/36 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.