Develop

.github/workflows/ci.yml

@@ -88,7 +88,7 @@ jobs:
           cache: true
 
       - name: Install gosec
-        run: go install github.com/securego/gosec/v2/cmd/gosec@v2.29.0
+        run: go install github.com/securego/gosec/v2/cmd/gosec@v2.30.0
 
       # Note: do not use -quiet here: it suppresses the report output
       # entirely, including the -out SARIF file (the file is then never
@@ -105,6 +105,20 @@ jobs:
         with:
           sarif_file: results.sarif
 
+  # -- Markdown docs: Mermaid diagram syntax --
+  # Uses the Node.js preinstalled on the runner (the check needs >= 20.11).
+  docs:
+    name: Docs (Mermaid)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Check Mermaid diagrams
+        run: make check-mermaid
+
   # -- Helm lint & package --
   helm:
     name: Helm lint
@@ -120,6 +134,21 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v5
 
+      # On a tag push, bake the tag into the chart before it is packaged and
+      # pushed: appVersion and codx image tag take the git tag, and the chart
+      # patch version is bumped (version: X.Y.Z -> X.Y.Z+1). Branch and PR
+      # builds package the chart as committed.
+      - name: Stamp release tag into chart
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          sed -i -E "s|^appVersion: \".*\"$|appVersion: \"${tag}\"|" charts/codx/Chart.yaml
+          awk -F. -v OFS=. '/^version:/ { $(NF) = $(NF) + 1 } { print }' \
+            charts/codx/Chart.yaml > charts/codx/.Chart.yaml.tmp
+          mv charts/codx/.Chart.yaml.tmp charts/codx/Chart.yaml
+          sed -i -E "0,/^  tag: .*/s//  tag: \"${tag}\"/" charts/codx/values.yaml
+          echo "appVersion and image.tag set to ${tag}, chart version: $(sed -n 's/^version: //p' charts/codx/Chart.yaml)"
+
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v4
@@ -142,7 +171,7 @@ jobs:
             --set oidc.clientSecret=secret \
             --set oidc.redirectUrl=https://codx.example.com/auth/callback \
             --set redis.host=valkey:6379 \
-            --set ingress.host=codx.example.com \
+            --set ingress.hostname=codx.example.com \
             > /dev/null
 
       - name: Helm package

AGENTS.md

@@ -26,6 +26,8 @@ for the ground rules and [docs/](docs/) for the feature documentation.
 ## Language and style
 
 - **English everywhere**: code, comments, commit messages, docs, chart values.
+- Diagrams in Markdown docs are Mermaid (` ```mermaid ` fenced blocks), not
+  ASCII art.
 - `gofmt` clean; comments explain *why*, not *what*; minimal diffs that match
   the surrounding style.
 - Conventional commits (`feat:`, `fix:`, `docs:`, `chore:`), as used in the
@@ -58,7 +60,7 @@ gofmt -l internal/ cmd/ api/        # empty output = clean
 ### SAST (gosec) - security-sensitive or Go changes
 
 ```sh
-go install github.com/securego/gosec/v2/cmd/gosec@v2.29.0   # version pinned in CI
+go install github.com/securego/gosec/v2/cmd/gosec@v2.30.0   # version pinned in CI
 "$(go env GOPATH)/bin/gosec" -fmt=sarif -out=results.sarif ./...   # exit 0 = clean
 ```
 
@@ -106,6 +108,17 @@ make check-values-docs
 - When the CRD (`charts/codx/crds/`) changes, regenerate the docs with
   `make docs-crd`.
 
+### Docs (Markdown changes)
+
+```sh
+make check-mermaid
+```
+
+- Validates the syntax of every ` ```mermaid ` block in the Markdown files
+  with the real Mermaid parser (`hack/check_mermaid.mjs`, Node + jsdom, no
+  browser). Diagrams in docs are Mermaid, never ASCII art. The node_modules
+  are installed into a throwaway directory, not the repository.
+
 ### Workflows (changes under `.github/`)
 
 Validate the YAML parses (`python3 -c "import yaml; yaml.safe_load(open(...))"`)
@@ -117,13 +130,14 @@ A change is only done when these pass - they mirror the local commands above:
 
 - **go**: `go vet` + `go test -race` with coverage
 - **lint**: golangci-lint
-- **security**: gosec v2.29.0, SARIF uploaded to code scanning (needs
+- **security**: gosec v2.30.0, SARIF uploaded to code scanning (needs
   `security-events: write` + `actions: read`)
 - **helm**: dependency update, lint, template render check, package, OCI push
   + cosign sign
 - **docker**: amd64 build -> Trivy CVE gate (HIGH/CRITICAL, ignore-unfixed)
   -> CycloneDX SBOM (artifact + cosign attest) -> multi-arch build/push ->
   cosign sign. The image is scanned **before** it is pushed.
+- **docs**: Mermaid diagram syntax check (`make check-mermaid`).
 
 Pull requests are reviewed by the code owners (`.github/CODEOWNERS`).
 

Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # -- Build stage --
-FROM golang:1.27-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 WORKDIR /src
 

Makefile

@@ -52,6 +52,19 @@ docs-crd:
 check-values-docs:
 	python3 hack/check_values_docs.py charts/codx/values.yaml
 
+# Validate the syntax of the mermaid diagrams in the Markdown files with
+# the real Mermaid parser (syntax only, no rendering). The node_modules are
+# installed into a throwaway directory so the repository stays free of
+# JavaScript dependencies. Requires node and npm on PATH.
+# ":=" expands mktemp once: a lazy "?=" would run it per reference and the
+# install and the NODE_PATH would point at two different directories.
+MERMAID_CHECK_DIR := $(shell mktemp -d)
+
+.PHONY: check-mermaid
+check-mermaid:
+	npm --prefix $(MERMAID_CHECK_DIR) install --no-audit --no-fund --silent mermaid@11 jsdom >/dev/null
+	NODE_PATH=$(MERMAID_CHECK_DIR)/node_modules node hack/check_mermaid.mjs
+
 # Scan the Go modules (go.mod/go.sum) for known CVEs, like the CI does on
 # the Docker image. Requires trivy on PATH (https://trivy.dev).
 # Fails on HIGH/CRITICAL findings with a fix available.

charts/codx/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 2.41.0
 - name: valkey
   repository: oci://ghcr.io/valkey-io/valkey-helm
-  version: 0.12.0
-digest: sha256:bdfd5df0224e07bb230f7efdd218dbe959a02dbc9c7f3fad52b19295cfb559d4
-generated: "2026-10-13T15:21:42.428651669+02:00"
+  version: 0.12.1
+digest: sha256:12e757ddc2f8f1122d79ac7b077d577ba8a7ff328912c54d63a6b34b79d0a48a
+generated: "2026-10-28T17:43:33.664164823+01:00"

charts/codx/Chart.yaml

@@ -28,7 +28,7 @@ dependencies:
     repository: oci://ghcr.io/valkey-io/valkey-helm
     tags:
       - valkey
-    version: 0.12.0
+    version: 0.12.1
 annotations:
   category: DeveloperTools
   artifacthub.io/images: |