.gitignore

@@ -0,0 +1,2 @@
+dist/
+node_modules/

AGENTS.md

@@ -0,0 +1,8 @@
+# Fixture Review Contract
+
+- Canonical E2E source lives in `Maidn/maidn-e2e-secret`; `origin` must target that repository.
+- `test-org-2` is disposable-only and must never be treated as the test-suite source or delivery owner.
+- Keep fixture changes on one scoped branch and open a Forgejo pull request for review.
+- Before review, run `git diff --check` and the applicable build or test command.
+- Return review requests as: PR URL, branch, purpose, checks, risk, and merge action.
+- Do not commit credentials, token files, generated workspaces, or Kubernetes Secret values.

Dockerfile

@@ -0,0 +1,17 @@
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package.json .
+RUN npm install --package-lock=false
+COPY tsconfig.json .
+COPY src ./src
+RUN npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+ENV NODE_ENV=production PORT=8080
+COPY package.json .
+RUN npm install --omit=dev --package-lock=false && npm cache clean --force
+COPY --from=build /app/dist ./dist
+USER node
+EXPOSE 8080
+CMD ["npm", "start"]

charts/maidn-e2e-secret/Chart.yaml

@@ -1,4 +0,0 @@
-apiVersion: v2
-name: maidn-e2e-secret
-description: Maidn E2E secret runtime fixture
-version: 0.1.0

charts/maidn-e2e-secret/templates/deployment.yaml

@@ -1,48 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Chart.Name }}
-  labels:
-    app: {{ .Chart.Name }}
-spec:
-  replicas: {{ .Values.replicaCount }}
-  selector:
-    matchLabels:
-      app: {{ .Chart.Name }}
-  template:
-    metadata:
-      labels:
-        app: {{ .Chart.Name }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- range . }}
-        - name: {{ . | quote }}
-        {{- end }}
-      {{- end }}
-      containers:
-        - name: {{ .Chart.Name }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: 8080
-          {{- if or (eq .Release.Namespace "staging") (eq .Release.Namespace "production") }}
-          env:
-            - name: E2E_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: {{ printf "%s-runtime-%s" .Chart.Name .Release.Namespace }}
-                  key: {{ .Values.runtimeSecret.key | quote }}
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: {{ printf "%s-postgres-app" .Release.Namespace }}
-                  key: uri
-            - name: MAIDN_RUNTIME_REQUIRED
-              value: "true"
-          {{- end }}
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http

charts/maidn-e2e-secret/templates/forgejo-registry-credentials.yaml

@@ -1,20 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: forgejo-registry-credentials
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao
-  target:
-    name: forgejo-registry-credentials
-    creationPolicy: Owner
-    template:
-      type: kubernetes.io/dockerconfigjson
-      data:
-        .dockerconfigjson: "{{ `{{ .dockerconfigjson }}` }}"
-  data:
-    - secretKey: dockerconfigjson
-      remoteRef:
-        key: cicd/forgejo-registry
-        property: dockerconfigjson

charts/maidn-e2e-secret/templates/httproute.yaml

@@ -1,20 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  parentRefs:
-    - name: {{ .Values.gateway.name }}
-      namespace: {{ .Values.gateway.namespace }}
-      sectionName: http
-    - name: {{ .Values.gateway.name }}
-      namespace: {{ .Values.gateway.namespace }}
-      sectionName: https-wildcard
-  {{- with .Values.gateway.hostname }}
-  hostnames:
-    - {{ . | quote }}
-  {{- end }}
-  rules:
-    - backendRefs:
-        - name: {{ .Chart.Name }}
-          port: 8080

charts/maidn-e2e-secret/templates/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  type: ClusterIP
-  selector:
-    app: {{ .Chart.Name }}
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http

charts/maidn-e2e-secret/values.yaml

@@ -1,16 +0,0 @@
-replicaCount: 1
-
-image:
-  repository: ""
-  tag: dev
-  pullPolicy: IfNotPresent
-imagePullSecrets:
-  - forgejo-registry-credentials
-
-runtimeSecret:
-  key: e2e-secret
-
-gateway:
-  name: public
-  namespace: gateway-system
-  hostname: ""

package.json

@@ -0,0 +1,19 @@
+{
+  "name": "maidn-e2e-secret",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "npm run build && node --test test/health.test.js"
+  },
+  "dependencies": {
+    "express": "^5.1.0",
+    "pg": "^8.16.3"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.1",
+    "@types/node": "^22.15.0",
+    "@types/pg": "^8.15.5",
+    "typescript": "~5.8.0"
+  }
+}

preview/values.yaml

@@ -1 +0,0 @@
-replicaCount: 1

production/values.yaml

@@ -1,2 +0,0 @@
-gateway:
-  hostname: maidn-e2e-secret.dev02.nid3.com

src/health.ts

@@ -0,0 +1,23 @@
+import { Client } from 'pg';
+
+export async function isReady(selectOne = databaseSelectOne) {
+  if (process.env.MAIDN_RUNTIME_REQUIRED !== 'true') return true;
+  if (!process.env.E2E_SECRET || !process.env.DATABASE_URL) return false;
+
+  try {
+    await selectOne();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function databaseSelectOne() {
+  const client = new Client({ connectionString: process.env.DATABASE_URL });
+  await client.connect();
+  try {
+    await client.query('SELECT 1');
+  } finally {
+    await client.end();
+  }
+}

src/index.ts

@@ -0,0 +1,11 @@
+import express from 'express';
+import { isReady } from './health.js';
+
+const app = express();
+
+app.get('/', async (_request, response) => {
+  const ready = await isReady();
+  response.status(ready ? 200 : 503).send(ready ? 'maidn-e2e-secret-ready' : 'maidn-e2e-secret-not-ready');
+});
+
+app.listen(process.env.PORT ?? 8080);

staging/values.yaml

@@ -1,2 +0,0 @@
-gateway:
-  hostname: maidn-e2e-secret-staging.dev02.nid3.com

test/health.test.js

@@ -0,0 +1,33 @@
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { isReady } = require('../dist/health.js');
+
+test('readiness requires the secret and a successful database query', async () => {
+  const secret = process.env.E2E_SECRET;
+  const databaseUrl = process.env.DATABASE_URL;
+  const runtimeRequired = process.env.MAIDN_RUNTIME_REQUIRED;
+
+  try {
+    delete process.env.MAIDN_RUNTIME_REQUIRED;
+    assert.equal(await isReady(async () => assert.fail('query should not run')), true);
+
+    process.env.MAIDN_RUNTIME_REQUIRED = 'true';
+    delete process.env.E2E_SECRET;
+    assert.equal(await isReady(async () => assert.fail('query should not run')), false);
+
+    process.env.E2E_SECRET = 'configured';
+    delete process.env.DATABASE_URL;
+    assert.equal(await isReady(async () => assert.fail('query should not run')), false);
+
+    process.env.DATABASE_URL = 'postgres://example';
+    assert.equal(await isReady(async () => {}), true);
+    assert.equal(await isReady(async () => { throw new Error('unavailable'); }), false);
+  } finally {
+    if (secret === undefined) delete process.env.E2E_SECRET;
+    else process.env.E2E_SECRET = secret;
+    if (databaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = databaseUrl;
+    if (runtimeRequired === undefined) delete process.env.MAIDN_RUNTIME_REQUIRED;
+    else process.env.MAIDN_RUNTIME_REQUIRED = runtimeRequired;
+  }
+});

tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "dist",
+    "strict": true,
+    "target": "ES2022"
+  },
+  "include": ["src"]
+}