From 15881aa4d24fde3d6c5fa4faf52920d9dc9d1504 Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Thu, 20 Aug 2026 23:27:11 +0200 Subject: [PATCH] feat(platform): declare the ingest worker exempt from the health check knowledge-ingest-worker is a RabbitMQ consumer. Its cluster manifest declares no ports and no readiness or liveness probe, so there is no HTTP surface to probe, and the SC-11 health_declared check -- which requires a health.path from every workload -- could not be satisfied for this deployment. health.mandatory: false records that deliberately. The check now reports pass and names the exemption in its detail column, so the decision stays visible on every preview rather than being inferred from an absent field. Omitting health altogether is still a failure, which keeps an oversight distinguishable from a decision. The rendered output is byte-identical before and after: diff -rq over both out/manifests and out/apply reports no differences, and the worker still renders with no probes. This is a declaration change with no deployment impact. github-workflows pins move to v0.16.0, which is where the check honours the field and where a pin selects the action code that runs. --- .github/workflows/publish.yml | 6 +++--- platform/deployment.yml | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 09cee66..82c3ee9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,7 +29,7 @@ permissions: {} jobs: # -- 1a. Build and push knowledge-api image -------------------------------- publish-api-image: - uses: JorisJonkers-dev/github-workflows/.github/workflows/container-publish.yml@4b444f9a50edf76e4aea4148d73407c34a1e43a4 # v0.12.1 + uses: JorisJonkers-dev/github-workflows/.github/workflows/container-publish.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 with: platforms: linux/amd64,linux/arm64 image-name: knowledge/knowledge-api @@ -41,7 +41,7 @@ jobs: # -- 1b. Build and push knowledge-ingest-worker image ---------------------- publish-worker-image: - uses: JorisJonkers-dev/github-workflows/.github/workflows/container-publish.yml@4b444f9a50edf76e4aea4148d73407c34a1e43a4 # v0.12.1 + uses: JorisJonkers-dev/github-workflows/.github/workflows/container-publish.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 with: platforms: linux/amd64,linux/arm64 image-name: knowledge/knowledge-ingest-worker @@ -135,7 +135,7 @@ jobs: # -- 3. Render and publish the deploy artifact ---------------------------- publish-deploy-artifact: needs: [resolve-image-lock] - uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@5b5e93dc81846cac4e13118e7280fd81a143685e # v0.15.1 + uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 with: ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }} artifact-name: knowledge diff --git a/platform/deployment.yml b/platform/deployment.yml index c3d10e5..dacbdc7 100644 --- a/platform/deployment.yml +++ b/platform/deployment.yml @@ -59,6 +59,12 @@ spec: scope: authenticated - name: knowledge-ingest-worker + # A RabbitMQ consumer with no HTTP surface: its cluster manifest declares + # no ports and no probes, so there is nothing to probe. mandatory: false + # records that deliberately, rather than leaving health undeclared and + # indistinguishable from an oversight. + health: + mandatory: false stateful: true # Migration is complete (knowledge-vault-migrate-2026-05-18 has run and # is decommissioned per owner decision 2026-07-12). strategy: none