Build Lightpanda CDP image in CI

.github/workflows/publish-images.yml

@@ -25,6 +25,7 @@ jobs:
         service:
           - site-analyzer
           - scraper
+          - lightpanda-cdp
           - lightpanda-mcp
 
     steps:
@@ -65,6 +66,7 @@ jobs:
           set -euo pipefail
           sed -i -E "/name: ghcr\.io\/openstaticfish\/microservices\/site-analyzer/{n;s/newTag: .*/newTag: ${GITHUB_SHA}/;}" deploy/prod/kustomization.yaml
           sed -i -E "/name: ghcr\.io\/openstaticfish\/microservices\/scraper/{n;s/newTag: .*/newTag: ${GITHUB_SHA}/;}" deploy/prod/kustomization.yaml
+          sed -i -E "/name: ghcr\.io\/openstaticfish\/microservices\/lightpanda-cdp/{n;s/newTag: .*/newTag: ${GITHUB_SHA}/;}" deploy/prod/kustomization.yaml
           sed -i -E "/name: ghcr\.io\/openstaticfish\/microservices\/lightpanda-mcp/{n;s/newTag: .*/newTag: ${GITHUB_SHA}/;}" deploy/prod/kustomization.yaml
 
       - name: Commit production image tag update

README.md

@@ -430,9 +430,10 @@ On pushes to `main`, GitHub Actions builds and pushes these GHCR images:
 
 - `ghcr.io/openstaticfish/microservices/site-analyzer:<git-sha>`
 - `ghcr.io/openstaticfish/microservices/scraper:<git-sha>`
+- `ghcr.io/openstaticfish/microservices/lightpanda-cdp:<git-sha>`
 - `ghcr.io/openstaticfish/microservices/lightpanda-mcp:<git-sha>`
 
-The workflow also pushes `:main` as a convenience tag, but production uses the immutable `<git-sha>` tags in `deploy/prod/kustomization.yaml`. The prebuilt `lightpanda-cdp` image is pinned by digest in its Deployment. After app images are pushed, CI updates `deploy/prod/kustomization.yaml` to the new SHA and commits the tag update back to `main` with `[skip ci]`. The Gitea mirror pulls the update, then Flux reconciles `./deploy/prod` into the `microservices` namespace.
+The workflow also pushes `:main` as a convenience tag, but production uses the immutable `<git-sha>` tags in `deploy/prod/kustomization.yaml`. After app images are pushed, CI updates `deploy/prod/kustomization.yaml` to the new SHA and commits the tag update back to `main` with `[skip ci]`. The Gitea mirror pulls the update, then Flux reconciles `./deploy/prod` into the `microservices` namespace.
 
 Runtime secrets stay in Doppler project `openstaticfish-microservices`, config `dev`. Production manifests represent them only as External Secrets using `ClusterSecretStore/doppler-openstaticfish-microservices`. Do not put runtime secrets in GitHub, Gitea, images, or manifests.
 
@@ -570,6 +571,8 @@ curl http://apps.silverside-gopher.ts.net/lightpanda-mcp/healthz
     │   └── main.go
     ├── lightpanda-mcp/
     │   └── Dockerfile
+    ├── lightpanda-cdp/
+    │   └── Dockerfile
     └── site-analyzer/
         ├── Dockerfile
         ├── go.mod

deploy/prod/kustomization.yaml

@@ -26,5 +26,7 @@ images:
     newTag: 8ffe23ab7af39a86203638d16211da19447bcc4d
   - name: ghcr.io/openstaticfish/microservices/scraper
     newTag: 8ffe23ab7af39a86203638d16211da19447bcc4d
+  - name: ghcr.io/openstaticfish/microservices/lightpanda-cdp
+    newTag: 8ffe23ab7af39a86203638d16211da19447bcc4d
   - name: ghcr.io/openstaticfish/microservices/lightpanda-mcp
     newTag: 8ffe23ab7af39a86203638d16211da19447bcc4d

deploy/prod/lightpanda-cdp-deployment.yaml

@@ -23,7 +23,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: lightpanda-cdp
-          image: lightpanda/browser@sha256:7b05b1c2f618fad9ed77786132f47ef71091875528bc46e6b3852b75c361cb05
+          image: ghcr.io/openstaticfish/microservices/lightpanda-cdp:8ffe23ab7af39a86203638d16211da19447bcc4d
           args:
             - /bin/lightpanda
             - serve

services/lightpanda-cdp/Dockerfile

@@ -0,0 +1,5 @@
+FROM lightpanda/browser@sha256:7b05b1c2f618fad9ed77786132f47ef71091875528bc46e6b3852b75c361cb05
+
+ENV LIGHTPANDA_DISABLE_TELEMETRY=true
+
+EXPOSE 9222