rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate to custom oci registry

Browse Source 
Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-05-25 15:01:35 -07:00
parent bd04f1812a
commit d804c72c07
18 changed files with 224 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/claude/make.md
View File

@@ -55,7 +55,7 @@ Individual codegen is driven by `go generate`:
| Target | Purpose |
| ------------------- | ------------------------------------------------- |
| `make docker-build` | Build the Docker image (`ghcr.io/getprobo/probo`) |
| `make docker-build` | Build the Docker image (`artifact.probo.inc/probo/probo`) |
| `make sbom` | Source SBOM (CycloneDX) |
| `make sbom-docker` | Docker image SBOM |
| `make scan` | Vulnerability scan (Grype) on source + Docker |

7
contrib/claude/release/README.md
View File

@@ -1,6 +1,6 @@
# Release
The repository ships six independently-versioned tracks. Each has its own
The repository ships seven independently-versioned tracks. Each has its own
version source, its own `CHANGELOG.md`, its own tag pattern, and its own
release workflow. Cutting a release means: bump the version, write a
changelog entry, commit, tag, push.
@@ -13,6 +13,7 @@ changelog entry, commit, tag, push.
| `proboctl` | `proboctl/v*` | [proboctl.md](./proboctl.md) |
| `@probo/n8n-nodes-probo` | `@probo/n8n-nodes-probo/v*` | [n8n-nodes-probo.md](./n8n-nodes-probo.md) |
| `@probo/cookie-banner` | `@probo/cookie-banner/v*` | [cookie-banner.md](./cookie-banner.md) |
| Helm chart (`probo`) | `helm/v*` | [helm.md](./helm.md) |
When the user asks for a release **without specifying a track**, follow
[Step 1](#1-decide-which-tracks-to-release) below to detect which tracks
@@ -69,6 +70,10 @@ git log $(git describe --tags --abbrev=0 --match='@probo/n8n-nodes-probo/v*')..H
# @probo/cookie-banner
git log $(git describe --tags --abbrev=0 --match='@probo/cookie-banner/v*')..HEAD --oneline \
-- packages/cookie-banner
# helm chart
git log $(git describe --tags --abbrev=0 --match='helm/v*')..HEAD --oneline \
-- contrib/helm
```
If a track returns no commits, skip it. If all commits for a track are

34
contrib/claude/release/helm.md Normal file
View File

@@ -0,0 +1,34 @@
# Release Helm chart (`probo`)
After confirming commits below, follow the
[common steps](./README.md#3-common-steps-every-track).
## Track facts
- **Tag pattern**: `helm/v*`
- **Version source**: `contrib/helm/charts/probo/Chart.yaml` (`version` field)
- **Version bump**: Edit `version` in `contrib/helm/charts/probo/Chart.yaml`
- **Changelog**: `contrib/helm/charts/probo/CHANGELOG.md`
- **Files to stage**: `contrib/helm/charts/probo/Chart.yaml`,
`contrib/helm/charts/probo/CHANGELOG.md`
- **Workflow**: `.github/workflows/release-helm.yaml`
- **Path filter**: `contrib/helm`
## Detect commits
```shell
git log $(git describe --tags --abbrev=0 --match='helm/v*')..HEAD --oneline \
-- contrib/helm
```
If empty or non-user-facing only, do not release this track.
## Notes
The chart has its own SemVer (`version`). `appVersion` in `Chart.yaml` is
the default probod application version the chart deploys (image tag
`v<appVersion>`). Bump `appVersion` when the chart should default
to a newer probod release.
CI packages the chart and pushes it to
`oci://artifact.probo.inc/probo/probo`, then publishes a GitHub Release.

2
contrib/claude/release/probod.md
View File

@@ -32,6 +32,6 @@ The changelog covers changes across all four components (`probod`,
`@probo/console`, `@probo/trust`, `@probo/ui`).
CI builds the frontends and Go binaries, builds and pushes the
multi-arch image to `ghcr.io/getprobo/probo:probod-v<version>` (and
multi-arch image to `artifact.probo.inc/probo/probo:v<version>` (and
`:latest`), runs Trivy + cosign + attestations, and publishes the GitHub
Release.

17
contrib/helm/README.md
View File

@@ -18,7 +18,20 @@ Before deploying Probo, ensure you have:
## Install
#### Using Local Chart
### From OCI Registry
```bash
helm install my-probo oci://artifact.probo.inc/probo/probo --version <chart-version>
```
Replace `<chart-version>` with a released chart version (e.g. `0.1.0`). The
chart defaults to the probod image tag `v<appVersion>` from
`Chart.yaml`.
Configure secrets and external services with `--set` flags or a values file
(see [Helm Chart Documentation](charts/probo/README.md)).
### From Local Chart
##### Generate Secrets
@@ -302,7 +315,7 @@ spec:
| Key | Type | Default | Description |
|---------------------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| replicaCount | int | `1` | Number of Probo application replicas |
| image.repository | string | `"ghcr.io/getprobo/probo"` | Container image repository |
| image.repository | string | `"artifact.probo.inc/probo/probo"` | Container image repository |
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
| image.tag | string | `"latest"` | Overrides the image tag whose default is the chart appVersion |
| imagePullSecrets | list | `[]` | Image pull secrets for private registries |

5
contrib/helm/charts/probo/CHANGELOG.md Normal file
View File

@@ -0,0 +1,5 @@
# Changelog
All notable changes to the Probo Helm chart will be documented in this file.
## Unreleased

2
contrib/helm/charts/probo/Chart.yaml
View File

@@ -3,7 +3,7 @@ name: probo
description: A Helm chart for deploying Probo - Open Source Compliance Platform
type: application
version: 0.1.0
appVersion: "0.74.7"
appVersion: "0.191.0"
keywords:
- compliance
- soc2

24
contrib/helm/charts/probo/README.md
View File

@@ -12,7 +12,25 @@ This Helm chart deploys Probo - an open-source SOC-2 compliance platform - on Ku
## Installing the Chart
### Generate Required Secrets
### From OCI Registry
```bash
helm install probo oci://artifact.probo.inc/probo/probo --version <chart-version> \
--set probo.baseUrl="probo.example.com" \
--set probo.encryptionKey="$ENCRYPTION_KEY" \
--set probo.auth.cookieSecret="$COOKIE_SECRET" \
--set probo.auth.passwordPepper="$PASSWORD_PEPPER" \
--set probo.trustAuth.tokenSecret="$TRUST_TOKEN_SECRET" \
--set postgresql.host="postgres.example.com" \
--set postgresql.password="<db-password>" \
--set s3.bucket="probo-production" \
--set s3.accessKeyId="<aws-access-key-id>" \
--set s3.secretAccessKey="<aws-secret-access-key>"
```
### From Local Chart
#### Generate Required Secrets
```bash
# Generate required secrets
@@ -63,7 +81,7 @@ For production, create a `values-production.yaml` file:
```yaml
# values-production.yaml
image:
repository: ghcr.io/getprobo/probo
repository: artifact.probo.inc/probo/probo
tag: "0.74.7"
replicaCount: 3
@@ -147,7 +165,7 @@ The following parameters **must** be configured:
| Parameter | Description | Default |
|------------------------|---------------------------------|---------|
| `image.repository` | Probo image repository | `ghcr.io/getprobo/probo` |
| `image.repository` | Probo image repository | `artifact.probo.inc/probo/probo` |
| `image.tag` | Probo image tag | Chart appVersion |
| `replicaCount` | Number of Probo replicas | `1` |
| `probo.baseUrl` | Public baseUrl | `probo.example.com` |

2
contrib/helm/charts/probo/templates/deployment.yaml
View File

@@ -35,7 +35,7 @@ spec:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
env:
- name: CONFIG_FILE

2
contrib/helm/charts/probo/values-production.yaml.example
View File

@@ -4,7 +4,7 @@
# Use specific version tag
image:
repository: ghcr.io/getprobo/probo
repository: artifact.probo.inc/probo/probo
tag: "0.74.7"
pullPolicy: IfNotPresent

4
contrib/helm/charts/probo/values.yaml
View File

@@ -5,10 +5,10 @@
replicaCount: 1
image:
repository: ghcr.io/getprobo/probo
repository: artifact.probo.inc/probo/probo
pullPolicy: Always
# Overrides the image tag whose default is the chart appVersion.
tag: "latest"
tag: ""
imagePullSecrets: []
nameOverride: ""