EXP-2086: Add K8s/nginx container deployment (pattern-prover) - #75
Merged
Conversation
Adds the standard containerised-frontend deployment shape, mirrored from codat-internal/admin-ui: - Dockerfile: nginx:alpine-slim final stage serving the Docusaurus build - nginx.conf: static serving with real 404s via Docusaurus's 404.html (no SPA fallback), same hardening headers as admin-ui - deployment/docker: node-build:24 build stage (git installed and .git kept in context so showLastUpdateAuthor/Time stay real) + docker-bake - deployment/charts: codat.legal chart on codat-classic-app; legal-integration.codat.io (intg) / legal.codat.io (prod) - deployment/build.azure-pipelines.yaml: Helm/build.frontend.job.yaml + Helm/deploy.job.yaml, ArgoApplicationName legal GitHub Pages deploy stays live and untouched; cutover is a DNS-only change in infrastructure-as-code once the intg hostname verifies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pmckinney-codat
marked this pull request as ready for review
July 28, 2026 12:36
Decision: stay on the ADO codat-npm feed (supply-chain controls) rather
than switching to registry.npmjs.org.
The committed .npmrc previously carried `${NPM_TOKEN}` env-substitution
credential lines, which break any npm invocation where NPM_TOKEN is
unset — including npm ci inside the docker build stage. Match the
admin-ui/link-amex shape instead: registry + always-auth only, with
credentials injected at build time by whoever runs the build:
- ADO pipeline: npm authenticate against the feed before the bake
(the mechanism admin-ui and link-amex already rely on)
- GH Pages workflows: new "Authenticate to codat-npm feed" step writes
the same three credential lines to ~/.npmrc from secrets.NPM_TOKEN
Behaviour for fork PRs is unchanged: no secret, so npm ci still fails.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
add_header only applies to 2xx/3xx responses by default, so the real-404 behaviour this config introduces was serving unknown paths without HSTS, X-Frame-Options etc. `always` keeps the headers on every response. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pmckinney-codat
enabled auto-merge
July 30, 2026 14:11
npm >=7 always sends URI-scoped credentials to the matching registry, so the flag is a no-op for this npm-only repo and npm on Node 24 warns it will stop working. Raised by Rachel on the PR (and previously in Slack, Mar 2026). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Rachel-Codat
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Jira
EXP-2086 (pattern-prover for EXP-2076)
What
Adds the standard containerised-frontend deployment shape so legal.codat.io can move from GitHub Pages onto a container on the Argo workload clusters. Mirrored from
codat-internal/admin-ui:Dockerfile—nginx:1.29.6-alpine-slimfinal stage serving the Docusaurusbuild/output. Norun-app.sh: there is no runtime env injection here, nginx starts directly.nginx.conf— admin-ui's config minus the SPA fallback: unknown paths return a real 404 via Docusaurus's generated404.html(try_files $uri $uri/ =404+error_page 404 /404.html).deployment/docker/—build.dockerfileonbase-images/node-build:24-bookworm-slim(Node 24 matches the Pages workflow). Installsgitand keeps.gitin the build context soshowLastUpdateAuthor/Timeread real history (same reasondeploy.ymlusesfetch-depth: 0).deployment/charts/—codat.legalchart oncodat-classic-app(>=2.6.1). Hosts:legal-integration.codat.io(intg) /legal.codat.io(prod). Small footprint (intg 1–2 replicas, prod 2–3, PDB 1) — traffic is minimal.deployment/build.azure-pipelines.yaml—Helm/build.frontend.job.yaml+Helm/deploy.job.yaml,ArgoApplicationName: legal.GitHub Pages keeps serving prod — the Pages workflows still run on every merge. Cutover is a one-line DNS change in infrastructure-as-code once the intg hostname verifies; Pages decommission is a separate cleanup after a soak.
npm feed (decided: keep codat-npm)
Staying on the ADO feed for supply-chain control. The committed
.npmrcis now credential-less (registry +always-auth, matching admin-ui/link-amex) because the old${NPM_TOKEN}substitution lines break any npm run where the var is unset — includingnpm ciinside the image build. Credentials are injected at build time instead:.npmrcbefore the bake — the same mechanism admin-ui and link-amex rely on.~/.npmrcfromsecrets.NPM_TOKEN.Fork-PR behaviour is unchanged (no secret →
npm cifails, as before).Still outside this PR
CustomCapabilitiesfor this repo on the managed pool, and confirming thecodat-techservice connection reaches the codatio org — tracked on EXP-2086.Companion PRs
Applications/legal.yamlApplicationSet🤖 Generated with Claude Code