Later: The chart is the owner's and agents keep out of charts/; this waits until the owner makes that exception or does it in the deployment repo.
Replaces #1539, whose contract was stale: the code reads FORGE_CHECKS_*, not FORGE_JOB_*, and the check Job's pods carry the label forge-check: "true" (src/checks/job_step.ts JOB_LABELS), not forge.plat.sh/lane: check.
Done looks like:
[ ] With lane.enabled=false (the default) helm template charts/app renders exactly what it renders on main today.
[ ] With lane.enabled=true it renders a ServiceAccount, a Role in the release namespace (jobs create/get/list/watch/delete; pods get/list; pods/log get; nothing else), its RoleBinding, and a NetworkPolicy selecting forge-check: "true" with no ingress and egress only to the forge pod (app: <release>) and DNS.
[ ] The deployment then sets serviceAccountName and exactly the env src/checks/placement.ts reads: FORGE_CHECKS_PLACEMENT=job, FORGE_CHECKS_IMAGE, FORGE_CHECKS_CLAIM, FORGE_CHECKS_NODE_SELECTOR, FORGE_CHECKS_TOLERATIONS. A test fails if the chart names an env var placement.ts does not read.
[ ] The pull shows the rendered output of both settings, since helm render tests skip in the sandbox.
[ ] docs/APPS.md (where FORGE_CHECKS_PLACEMENT is documented) says how to confirm it: kubectl exec deploy/<release> -- printenv FORGE_CHECKS_PLACEMENT answers job.
Files: charts/app/templates/lane.yaml (new), charts/app/templates/deployment.yaml, charts/app/values.yaml, docs/APPS.md, test/chart-lane.test.ts.
Risk: a NetworkPolicy that selects the wrong label silently blocks nothing; the label test above is what guards it.
Later: The chart is the owner's and agents keep out of charts/; this waits until the owner makes that exception or does it in the deployment repo.
Replaces #1539, whose contract was stale: the code reads FORGE_CHECKS_*, not FORGE_JOB_*, and the check Job's pods carry the label
forge-check: "true"(src/checks/job_step.ts JOB_LABELS), notforge.plat.sh/lane: check.Done looks like:
lane.enabled=false(the default)helm template charts/apprenders exactly what it renders on main today.lane.enabled=trueit renders a ServiceAccount, a Role in the release namespace (jobs create/get/list/watch/delete; pods get/list; pods/log get; nothing else), its RoleBinding, and a NetworkPolicy selectingforge-check: "true"with no ingress and egress only to the forge pod (app: <release>) and DNS.serviceAccountNameand exactly the env src/checks/placement.ts reads: FORGE_CHECKS_PLACEMENT=job, FORGE_CHECKS_IMAGE, FORGE_CHECKS_CLAIM, FORGE_CHECKS_NODE_SELECTOR, FORGE_CHECKS_TOLERATIONS. A test fails if the chart names an env var placement.ts does not read.kubectl exec deploy/<release> -- printenv FORGE_CHECKS_PLACEMENTanswersjob.Files: charts/app/templates/lane.yaml (new), charts/app/templates/deployment.yaml, charts/app/values.yaml, docs/APPS.md, test/chart-lane.test.ts. Risk: a NetworkPolicy that selects the wrong label silently blocks nothing; the label test above is what guards it.