release: push gateway chart 0.3.1

[brow]

Publishes chart 0.3.1 for buzz-push-gateway, containing #7717.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: fe808eae0e1194be48923567c4e0f179aead5acf...c478884c13d493b19c1ede07330d534c19b0fb0a
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

The PR only increments the push-gateway Helm chart version from 0.3.0 to 0.3.1, correctly publishing the previously merged HTTP service-label fix. The release branch, chart metadata, workspace app version, immutable tag workflow, and publisher validation are consistent.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• No additional limitations were reported.

---

_{Generated by Codex Security Review |
Requested by: @brow |
Workflow run}

[brow]

@codex review

[brow]

@builderbot review

[brow]

@buzz-security-review c478884

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T23:57:06.154727Z	c478884	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: c478884c13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No actionable findings in this version-only release change.

Reviewed head c478884c13d493b19c1ede07330d534c19b0fb0a against base fe808eae0e1194be48923567c4e0f179aead5acf.

• deploy/charts/buzz-push-gateway/Chart.yaml:6 is the sole changed line: 0.3.0 → 0.3.1. appVersion: "0.1.0" remains consistent with the workspace package version. The exact base is #7717’s merge commit; the head retains its plaintext-HTTP Service port fix.
• The same-repository branch push-chart-release/0.3.1 matches the existing auto-tag lane and publisher’s push-chart-v0.3.1/chart-version contract. No push-chart-v0.3.1 tag appeared in the GitHub tag-prefix response at review time.
• Hosted chart validation succeeded for this head, including the render and release-contract steps: https://github.com/block/buzz/actions/runs/35407234909/job/105799413134. Source/metadata review only: no PR code was checked out, built, tested, sourced, imported, or executed locally. This is not certification of OCI publication, downstream rollout, or live push delivery; those remain post-merge release operations.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: fe808eae0e1194be48923567c4e0f179aead5acf..c478884c13d493b19c1ede07330d534c19b0fb0a (exact head c478884c13d493b19c1ede07330d534c19b0fb0a)
Risk: medium — release metadata publishes an immutable chart containing a deliberate Service port-name compatibility change; runtime ports, image, schema, and app version do not change.

Behavior/contracts traced: #7717 ancestry and packaged contents; rendered default/production/Gateway API Services; in-chart and searched downstream consumers; release branch → merge SHA → immutable tag → OCI publisher; collision handling, provenance, upgrade, disablement, and rollback.

Concrete defects: none.

• The only PR delta is deploy/charts/buzz-push-gateway/Chart.yaml:6, 0.3.0 → 0.3.1; base fe808eae… is #7717's merge commit. Packaged/rendered 0.3.1 contains name: http, port: 8080, and targetPort: public, plus the regression assertions. There is no dependency/vendor, image, schema, or appVersion drift.
• The chart-owned HTTPRoute selects the Service by numeric port (templates/httproute.yaml:14-15). Scoped tracked-source searches in block/buzz found no remaining named https consumer; a broader non-fork/non-archived squareup/* search found no checked-in consumer. External live objects remain operator inventory.
• Branch push-chart-release/0.3.1 follows the documented lane. .github/workflows/auto-tag-on-release-pr-merge.yml:72-74,97,137-161 targets the merge SHA and rejects conflicting/racing tags; .github/workflows/push-gateway-helm-chart.yml:49-68 checks tag/version agreement before packaging and publishing. push-chart-v0.3.1 is currently absent, as expected pre-merge. OCI 0.3.0 remains fetchable.
• Rollback to 0.3.0 is mechanically available but restores the incorrect https discovery label; if protocol discovery regresses, the safer operational stop is documented BUZZ_PUSH_ENABLED=false, followed by diagnosis.

Author action: none.
Verification owner: release workflow/operator for post-merge tag/artifact inspection and deployment/GitOps owner for external named-port inventory plus first-cluster health.

Validation at matching clean HEAD: pinned Hermit environment; git diff --check; deploy/charts/buzz-push-gateway/tests/render.sh; deploy/charts/buzz-push-gateway/tests/release-contract.sh; helm package and render/inspection of the resulting 0.3.1 archive — all passed. Exact-head CI passes push-gateway validate, chart lint + unittest + render matrix, DCO, Semgrep, and zizmor; publish and gated kind install correctly skipped on the PR.

Confidence gaps / residual risk: OCI 0.3.1 and its tag do not exist until merge, and no live cluster upgrade was run. After publication, inspect helm show chart, pull/unpack 0.3.1, confirm tag target = merge SHA and the rendered Service tuple, then observe mesh/backend health. The chart lane emits no cryptographic OCI attestation; that is a pre-existing provenance limitation, not introduced here. External runtime objects may still refer to https by name despite no checked-in consumer found. Author action for each: none; verification owner: release/deployment operator.