feat(operator): add PowerSync and self-contained deployment

.dockerignore

@@ -3,6 +3,7 @@
 **
 
 # Re-include Go source files (but not *_test.go)
+!**/
 !**/*.go
 **/*_test.go
 

.github/workflows/ci.yaml

@@ -5,11 +5,15 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+env:
+  IMAGE_NAME: ghcr.io/guionai/cloudnative-supabase
+
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -23,31 +27,25 @@ jobs:
       - name: Download dependencies
         run: go mod download
 
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Set up Tanka
+        run: go install github.com/grafana/tanka/cmd/tk@v0.37.4
+
       - name: Run tests
-        run: go test ./pkg/... -v
+        run: make test test-tanka test-delivery
 
       - name: Build
         run: go build -o bin/manager cmd/main.go
 
       - name: Generate manifests
         run: make generate manifests
 
-      - name: Sync CRDs to Helm chart
+      - name: Check generated files
         run: |
           cp config/crd/bases/*.yaml charts/cloudnative-supabase/crds/
-
-          if [ -z "$(git status --porcelain charts/cloudnative-supabase/crds/)" ]; then
-            echo "Helm chart CRDs already in sync"
-            exit 0
-          fi
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          git add charts/cloudnative-supabase/crds/
-          git commit -m "chore(chart): sync CRDs from generated manifests"
-          git pull --rebase origin main
-          git push origin main
+          git diff --exit-code
 
   lint:
     runs-on: ubuntu-latest
@@ -64,12 +62,15 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.5.0
           args: --timeout=5m
 
   docker:
     runs-on: ubuntu-latest
     needs: [build, lint]
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -84,14 +85,22 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest
+            type=sha,format=long
+
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           platforms: linux/amd64
-          tags: |
-            ghcr.io/guionai/cloudnative-supabase:latest
-            ghcr.io/guionai/cloudnative-supabase:${{ github.sha }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/pr.yaml

@@ -21,22 +21,22 @@ jobs:
       - name: Download dependencies
         run: go mod download
 
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Set up Tanka
+        run: go install github.com/grafana/tanka/cmd/tk@v0.37.4
+
       - name: Run tests
-        run: go test ./pkg/... -v
+        run: make test test-tanka test-delivery
 
       - name: Build
         run: go build -o bin/manager cmd/main.go
 
-      - name: Generate manifests
-        run: make generate manifests
-
-      - name: Check for uncommitted changes
+      - name: Check generated manifests
         run: |
-          if [ -n "$(git status --porcelain)" ]; then
-            echo "Generated files are out of date. Run 'make generate manifests' and commit the changes."
-            git status --porcelain
-            exit 1
-          fi
+          cp config/crd/bases/*.yaml charts/cloudnative-supabase/crds/
+          git diff --exit-code
 
   lint:
     runs-on: ubuntu-latest
@@ -53,5 +53,24 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.5.0
           args: --timeout=5m
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: [build, lint]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          platforms: linux/amd64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release.yaml

@@ -8,6 +8,7 @@ on:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: guionai/cloudnative-supabase
+  CHART_REGISTRY: oci://ghcr.io/guionai/charts
 
 jobs:
   release:
@@ -25,8 +26,20 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Set up Tanka
+        run: go install github.com/grafana/tanka/cmd/tk@v0.37.4
+
       - name: Run tests
-        run: go test ./pkg/... -v
+        run: make test test-tanka test-delivery
+
+      - name: Generate and check manifests
+        run: |
+          make generate manifests
+          cp config/crd/bases/*.yaml charts/cloudnative-supabase/crds/
+          git diff --exit-code
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -46,7 +59,6 @@ jobs:
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest
 
       - name: Build and push
         uses: docker/build-push-action@v6
@@ -59,37 +71,19 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Package and push Helm chart
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
+          mkdir -p dist
+          helm package charts/cloudnative-supabase --version "${VERSION}" --app-version "${VERSION}" --destination dist
+          helm push "dist/cloudnative-supabase-${VERSION}.tgz" "${CHART_REGISTRY}"
+          helm pull "${CHART_REGISTRY}/cloudnative-supabase" --version "${VERSION}" --destination /tmp
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
           files: |
             config/crd/bases/*.yaml
-
-      - name: Commit and push chart version
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Fetch the latest main branch
-          git fetch origin main
-
-          # Checkout main branch
-          git checkout main
-
-          # Apply version updates on main
-          sed -i "s/^version: .*/version: ${VERSION}/" charts/cloudnative-supabase/Chart.yaml
-          sed -i "s/^appVersion: .*/appVersion: ${VERSION}/" charts/cloudnative-supabase/Chart.yaml
-          sed -i "s/^  tag: .*/  tag: \"${VERSION}\"/" charts/cloudnative-supabase/values.yaml
-
-          git add charts/cloudnative-supabase/Chart.yaml charts/cloudnative-supabase/values.yaml
-
-          # Only commit if there are staged changes
-          if git diff --cached --quiet; then
-            echo "Chart already at correct version, skipping commit"
-          else
-            git commit -m "chore(chart): bump to ${VERSION}"
-            git push origin main
-          fi
+            dist/*.tgz

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.25 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
@@ -19,7 +19,7 @@ COPY . .
 # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager ./cmd
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details

Makefile

@@ -61,6 +61,36 @@ vet: ## Run go vet against code.
 test: manifests generate fmt vet setup-envtest ## Run tests.
 	KUBEBUILDER_ASSETS="$(shell "$(ENVTEST)" use $(ENVTEST_K8S_VERSION) --bin-dir "$(LOCALBIN)" -p path)" go test $$(go list ./... | grep -v /e2e) -coverprofile cover.out
 
+.PHONY: test-tanka
+test-tanka: ## Render and validate the self-contained Tanka environment.
+	bash hack/test-tanka.sh
+
+.PHONY: test-delivery
+test-delivery: ## Validate release and deployment invariants.
+	bash hack/test-delivery.sh
+
+TANKA_ENV ?= tanka/environments/guion
+TANKA_IMAGE ?=
+
+.PHONY: require-tanka-image
+require-tanka-image:
+	@printf '%s\n' "$(TANKA_IMAGE)" | grep -Eq '^(sha-[0-9a-f]{40}|[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?)$$' || { \
+		echo "TANKA_IMAGE must be a full sha-<40 hex> or semantic-version tag" >&2; \
+		exit 1; \
+	}
+
+.PHONY: tanka-show
+tanka-show: require-tanka-image ## Render the operator Tanka environment.
+	tk show $(TANKA_ENV) --ext-str imageTag=$(TANKA_IMAGE)
+
+.PHONY: tanka-diff
+tanka-diff: require-tanka-image ## Diff the operator Tanka environment against its cluster.
+	tk diff $(TANKA_ENV) --ext-str imageTag=$(TANKA_IMAGE)
+
+.PHONY: tanka-apply
+tanka-apply: require-tanka-image ## Apply the operator Tanka environment to its cluster.
+	tk apply $(TANKA_ENV) --ext-str imageTag=$(TANKA_IMAGE)
+
 # TODO(user): To use a different vendor for e2e tests, modify the setup under 'tests/e2e'.
 # The default setup assumes Kind is pre-installed and builds/loads the Manager Docker image locally.
 # CertManager is installed by default; skip with:
@@ -112,9 +142,6 @@ build: manifests generate fmt vet ## Build manager binary.
 run: manifests generate fmt vet ## Run a controller from your host.
 	go run ./cmd/main.go
 
-# If you wish to build the manager image targeting other platforms you can use the --platform flag.
-# (i.e. docker build --platform linux/arm64). However, you must enable docker buildKit for it.
-# More info: https://docs.docker.com/develop/develop-images/build_enhancements/
 .PHONY: docker-build
 docker-build: ## Build docker image with the manager.
 	$(CONTAINER_TOOL) build -t ${IMG} .
@@ -129,7 +156,7 @@ docker-push: ## Push docker image with the manager.
 # - have enabled BuildKit. More info: https://docs.docker.com/develop/develop-images/build_enhancements/
 # - be able to push the image to your registry (i.e. if you do not set a valid value via IMG=<myregistry/image:<tag>> then the export will fail)
 # To adequately provide solutions that are compatible with multiple platforms, you should consider using this option.
-PLATFORMS ?= linux/arm64,linux/amd64,linux/s390x,linux/ppc64le
+PLATFORMS ?= linux/amd64
 .PHONY: docker-buildx
 docker-buildx: ## Build and push docker image for the manager for cross-platform support
 	# copy existing Dockerfile and insert --platform=${BUILDPLATFORM} into Dockerfile.cross, and preserve the original Dockerfile