ci: add latest-image regression guard

.github/workflows/integration-reusable.yml

@@ -0,0 +1,74 @@
+name: Integration (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      imageTag:
+        description: "Image tag to test. Empty string defaults to chart appVersion."
+        type: string
+        default: ""
+      pullPolicy:
+        description: "Image pull policy (IfNotPresent for pinned, Always for rolling tags)."
+        type: string
+        default: "IfNotPresent"
+
+permissions:
+  contents: read
+
+jobs:
+  integration:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install kind
+        run: |
+          curl -sLo /tmp/kind-linux-amd64 \
+            https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64
+          curl -sLo /tmp/kind.sha256 \
+            https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64.sha256sum
+          (cd /tmp && sha256sum -c kind.sha256)
+          install -m 0755 /tmp/kind-linux-amd64 /usr/local/bin/kind
+
+      - name: Install kubectl
+        run: |
+          curl -sLo /tmp/kubectl \
+            "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
+          curl -sLo /tmp/kubectl.sha256 \
+            "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl.sha256"
+          echo "$(cat /tmp/kubectl.sha256)  /tmp/kubectl" | sha256sum -c -
+          install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
+
+      - name: Set up Helm
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        with:
+          version: v4.1.4
+
+      - name: Log image digest under test
+        if: inputs.imageTag != ''
+        run: |
+          echo "Testing image arcadedata/arcadedb:${{ inputs.imageTag }}"
+          docker buildx imagetools inspect "arcadedata/arcadedb:${{ inputs.imageTag }}" || true
+
+      - name: Create kind cluster
+        run: kind create cluster --wait 60s
+
+      - name: Install chart
+        run: |
+          helm install test-arcadedb charts/arcadedb/ \
+            --set replicaCount=3 \
+            --set persistence.enabled=false \
+            --set arcadedb.defaultDatabases="" \
+            --set image.tag="${{ inputs.imageTag }}" \
+            --set image.pullPolicy="${{ inputs.pullPolicy }}" \
+            --timeout 5m \
+            --wait
+
+      - name: Run integration tests
+        run: make test-integration
+
+      - name: Delete kind cluster
+        if: always()
+        run: kind delete cluster

.github/workflows/latest-image.yml

@@ -0,0 +1,18 @@
+name: CI - Latest Image Guard
+
+# Pre-release guard: exercises the chart against the rolling `latest` ArcadeDB
+# image so regressions in the upcoming release surface before it ships.
+on:
+  schedule:
+    - cron: "0 6 * * 1" # weekly, Monday 06:00 UTC (matches Dependabot cadence)
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  integration-latest:
+    uses: ./.github/workflows/integration-reusable.yml
+    with:
+      imageTag: latest
+      pullPolicy: Always

.github/workflows/lint.yml

@@ -39,50 +39,4 @@ jobs:
         run: make test-unit
 
   integration:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install kind
-        run: |
-          curl -sLo /tmp/kind-linux-amd64 \
-            https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64
-          curl -sLo /tmp/kind.sha256 \
-            https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64.sha256sum
-          (cd /tmp && sha256sum -c kind.sha256)
-          install -m 0755 /tmp/kind-linux-amd64 /usr/local/bin/kind
-
-      - name: Install kubectl
-        run: |
-          curl -sLo /tmp/kubectl \
-            "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl"
-          curl -sLo /tmp/kubectl.sha256 \
-            "https://dl.k8s.io/release/v1.30.0/bin/linux/amd64/kubectl.sha256"
-          echo "$(cat /tmp/kubectl.sha256)  /tmp/kubectl" | sha256sum -c -
-          install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
-
-      - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
-        with:
-          version: v4.1.4
-
-      - name: Create kind cluster
-        run: kind create cluster --wait 60s
-
-      - name: Install chart
-        run: |
-          helm install test-arcadedb charts/arcadedb/ \
-            --set replicaCount=3 \
-            --set persistence.enabled=false \
-            --set arcadedb.defaultDatabases="" \
-            --timeout 5m \
-            --wait
-
-      - name: Run integration tests
-        run: make test-integration
-
-      - name: Delete kind cluster
-        if: always()
-        run: kind delete cluster
+    uses: ./.github/workflows/integration-reusable.yml

.gitignore

@@ -1,2 +1,5 @@
 .cr-release-packages/
 .helm/
+.claude/settings.local.json
+.debug/
+.idea/

README.md

@@ -30,6 +30,26 @@ make test              # run all of the above
 
 Unit-test suites live in `charts/arcadedb/tests/` and use [helm-unittest](https://github.com/helm-unittest/helm-unittest). The plugin version is pinned in the `Makefile`.
 
+### Latest-image guard
+
+`.github/workflows/latest-image.yml` runs the full kind HA integration suite
+against the rolling `arcadedata/arcadedb:latest` image every Monday (and on
+manual `workflow_dispatch`). It is a **blocking** pre-release guard: a red run
+means the upcoming ArcadeDB release breaks the chart. It shares its steps with
+the PR integration job via `.github/workflows/integration-reusable.yml`, so both
+exercise an identical suite differing only by image tag.
+
+### Release-bump checklist
+
+When a new ArcadeDB version is released:
+
+1. Bump `version` and `appVersion` in `charts/arcadedb/Chart.yaml`.
+2. Update the pinned image literal in `charts/arcadedb/tests/statefulset_test.yaml`
+   to the new version, or `helm-unittest` will fail (it cannot reference
+   `Chart.AppVersion` in an assertion).
+3. The latest-image guard needs no change — it keeps watching the next cycle's
+   rolling image.
+
 ## Release
 
 New chart versions are published via the GitHub Actions Release workflow: