Make server CLI imports safe for CLI-only installs by handling missing uvicorn at runtime, and replace click-based log-level validation with a Typer callback plus coverage for invalid/normalized values. Isolate Docker ignore scope by introducing Dockerfile.server.dockerignore so server-only exclusions do not affect the default CLI image build, and add dedicated BDD checks for this behavior.
Also stabilize nox security_scan on Python 3.13 by pinning setuptools<81 for Semgrep's pkg_resources dependency and remove the unreachable lifespan return flagged by vulture.
ISSUES CLOSED: #928
Adds the Kubernetes/Helm deployment bundle for server mode with a
hardened Deployment, Service, optional TLS Ingress, configuration/secrets
wiring, Dockerfile.server packaging, and deployment documentation for
ticket #928.
Key components:
- Helm chart under k8s/ with Deployment, Service, optional Ingress,
ConfigMap, ServiceAccount, Secrets, NOTES, and optional Redis subchart.
- Multi-stage Dockerfile.server for server runtime deployment.
- Deployment-focused docs in k8s/README.md.
- Behave + Robot + benchmark coverage for chart/deployment wiring.
Review fixes applied:
- Rebased branch onto master (removed merge commit per rebase-only policy).
- Moved uvicorn import to module top level per Import Guidelines.
- Added SHA256 checksum verification for Helm binary downloads in CI.
- Added 405 Method Not Allowed for wrong methods on known ASGI paths.
- Fixed WebSocket close: consume connect event first, use code 1008.
- Added logging for unrecognised lifespan message types.
- Added security-hardening headers (content-length, x-content-type-options,
cache-control) to all ASGI HTTP responses.
- Constrained --log-level to valid uvicorn levels via click.Choice.
- Added Dockerfile.server build step to CI docker job.
- Standardised Dockerfile.server base image to python:3.13-slim.
- Split Dockerfile build tool install into separate layer for caching.
- Added credential file patterns to .dockerignore.
- Reverted unrelated semgrep pre-commit config change.
- Removed unused ReceiveCallable type alias from test steps.
- Fixed redundant shutil.which check in _render_chart helper.
- Improved deque error message in lifespan test receive mock.
- Updated test assertions for WebSocket close code 1008.
- Added BDD scenario for POST-to-known-path 405 response.
ISSUES CLOSED: #928
brent.edwards