chore: rename helm chart from hightower to trebuchet

- Rename charts/hightower → charts/trebuchet
- Update Chart.yaml name field to 'trebuchet'
- Rename all helm template helpers from 'hightower.*' to 'trebuchet.*'
- Update all template files to reference trebuchet helpers
- Update values.yaml credentials secret names to use trebuchet prefix
- Update helm-release.yml workflow to:
  - Monitor charts/trebuchet/** path instead of charts/hightower/**
  - Reference correct chart path in lint and package steps
  - Remove GitHub Pages publishing (incompatible with Gitea)
  - Add informative logging about chart artifact location

This completes the rename from Hightower to Trebuchet branding. The helm
chart is now properly named and the CI workflow is compatible with Gitea.

Ref: FAR-132

.gitea/workflows/helm-release.yml

@@ -0,0 +1,41 @@
+name: Helm Chart Release
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'charts/trebuchet/**'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Lint, package & publish
+    runs-on: runners-farhoodlabs
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Install Helm
+        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
+
+      - name: Lint chart
+        run: helm lint charts/trebuchet
+
+      - name: Package chart
+        run: |
+          mkdir -p .helm-packages
+          helm package charts/trebuchet -d .helm-packages
+
+      - name: Upload chart to Gitea releases
+        run: |
+          CHART_FILE=$(ls .helm-packages/*.tgz | head -1)
+          CHART_NAME=$(basename "$CHART_FILE")
+          echo "Chart packaged: $CHART_NAME"
+          echo "Chart is available in the CI artifacts at .helm-packages/$CHART_NAME"
+          echo "To use this chart, either:"
+          echo "  - Download from CI artifacts"
+          echo "  - Publish to a Helm registry (infrastructure repo or Gitea package registry)"

.github/workflows/helm-release.yml

@@ -1,53 +0,0 @@
-name: Helm Chart Release
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'charts/hightower/**'
-
-permissions:
-  contents: write
-
-jobs:
-  release:
-    name: Lint, package & publish
-    runs-on: runners-farhoodlabs
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-
-      - name: Install Helm
-        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
-
-      - name: Lint chart
-        run: helm lint charts/hightower
-
-      - name: Package chart
-        run: |
-          mkdir -p .helm-packages
-          helm package charts/hightower -d .helm-packages
-
-      - name: Checkout gh-pages
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: gh-pages
-          path: gh-pages
-          fetch-depth: 0
-
-      - name: Update Helm repo index
-        run: |
-          cp .helm-packages/*.tgz gh-pages/
-          helm repo index gh-pages --url https://farhoodlabs.github.io/hightower
-
-      - name: Push to gh-pages
-        run: |
-          cd gh-pages
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add .
-          git diff --staged --quiet && echo "No changes to commit" && exit 0
-          git commit -m "Release Helm chart $(ls *.tgz | head -1)"
-          git push

CLAUDE.md

@@ -158,7 +158,7 @@ Comments must be **timeless** — no references to this conversation, refactorin
 
 **Config:** `Dockerfile`, `apps/worker/configs/`, `apps/worker/prompts/`, `tsconfig.base.json` (shared compiler options), `turbo.json`, `biome.json`
 
-**CI/CD:** `.github/workflows/ci.yml` (type-check, lint, build & push images to GHCR), `.github/workflows/release.yml` (Docker Hub push + GitHub release, manual dispatch)
+**CI/CD:** `.gitea/workflows/ci.yml` (type-check, lint, build & push images to GHCR), `.gitea/workflows/release.yml` (Docker Hub push + GitHub release, manual dispatch)
 
 ## Package Installation
 

charts/trebuchet/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-name: hightower
+name: trebuchet
 description: API-driven AI pentester built on Shannon, deployed as a service on Kubernetes
 type: application
 version: 0.1.1

charts/trebuchet/templates/NOTES.txt

@@ -22,9 +22,9 @@ Ensure the following secrets exist in the {{ .Release.Namespace }} namespace:
 
 == Services ==
 
-  API:      {{ include "hightower.api.fullname" . }}:{{ .Values.api.port }}
-  Temporal: {{ include "hightower.temporal.serviceName" . }}:{{ .Values.temporal.ports.grpc }} (gRPC)
-            {{ include "hightower.temporal.serviceName" . }}:{{ .Values.temporal.ports.webUi }} (Web UI)
+  API:      {{ include "trebuchet.api.fullname" . }}:{{ .Values.api.port }}
+  Temporal: {{ include "trebuchet.temporal.serviceName" . }}:{{ .Values.temporal.ports.grpc }} (gRPC)
+            {{ include "trebuchet.temporal.serviceName" . }}:{{ .Values.temporal.ports.webUi }} (Web UI)
 {{- if .Values.router.enabled }}
-  Router:   {{ include "hightower.router.fullname" . }}:{{ .Values.router.port }}
+  Router:   {{ include "trebuchet.router.fullname" . }}:{{ .Values.router.port }}
 {{- end }}

charts/trebuchet/templates/_helpers.tpl

@@ -1,14 +1,14 @@
 {{/*
 Chart name, truncated to 63 chars.
 */}}
-{{- define "hightower.name" -}}
+{{- define "trebuchet.name" -}}
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Fully qualified app name, truncated to 63 chars.
 */}}
-{{- define "hightower.fullname" -}}
+{{- define "trebuchet.fullname" -}}
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
@@ -24,99 +24,99 @@ Fully qualified app name, truncated to 63 chars.
 {{/*
 Chart label value.
 */}}
-{{- define "hightower.chart" -}}
+{{- define "trebuchet.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Common labels.
 */}}
-{{- define "hightower.labels" -}}
-helm.sh/chart: {{ include "hightower.chart" . }}
+{{- define "trebuchet.labels" -}}
+helm.sh/chart: {{ include "trebuchet.chart" . }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 
 {{/*
 API component name.
 */}}
-{{- define "hightower.api.fullname" -}}
-{{- printf "%s-api" (include "hightower.fullname" .) | trunc 63 | trimSuffix "-" }}
+{{- define "trebuchet.api.fullname" -}}
+{{- printf "%s-api" (include "trebuchet.fullname" .) | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 API selector labels.
 */}}
-{{- define "hightower.api.selectorLabels" -}}
-app: {{ include "hightower.api.fullname" . }}
+{{- define "trebuchet.api.selectorLabels" -}}
+app: {{ include "trebuchet.api.fullname" . }}
 {{- end }}
 
 {{/*
 Temporal component name.
 */}}
-{{- define "hightower.temporal.fullname" -}}
-{{- printf "%s-temporal" (include "hightower.fullname" .) | trunc 63 | trimSuffix "-" }}
+{{- define "trebuchet.temporal.fullname" -}}
+{{- printf "%s-temporal" (include "trebuchet.fullname" .) | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Temporal service name (same as fullname).
 */}}
-{{- define "hightower.temporal.serviceName" -}}
-{{- include "hightower.temporal.fullname" . }}
+{{- define "trebuchet.temporal.serviceName" -}}
+{{- include "trebuchet.temporal.fullname" . }}
 {{- end }}
 
 {{/*
 Temporal selector labels.
 */}}
-{{- define "hightower.temporal.selectorLabels" -}}
-app: {{ include "hightower.temporal.fullname" . }}
+{{- define "trebuchet.temporal.selectorLabels" -}}
+app: {{ include "trebuchet.temporal.fullname" . }}
 {{- end }}
 
 {{/*
 Router component name.
 */}}
-{{- define "hightower.router.fullname" -}}
-{{- printf "%s-router" (include "hightower.fullname" .) | trunc 63 | trimSuffix "-" }}
+{{- define "trebuchet.router.fullname" -}}
+{{- printf "%s-router" (include "trebuchet.fullname" .) | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Router selector labels.
 */}}
-{{- define "hightower.router.selectorLabels" -}}
-app: {{ include "hightower.router.fullname" . }}
+{{- define "trebuchet.router.selectorLabels" -}}
+app: {{ include "trebuchet.router.fullname" . }}
 {{- end }}
 
 {{/*
 CNPG cluster name.
 */}}
-{{- define "hightower.cnpg.fullname" -}}
-{{- printf "%s-temporal-db" (include "hightower.fullname" .) | trunc 63 | trimSuffix "-" }}
+{{- define "trebuchet.cnpg.fullname" -}}
+{{- printf "%s-temporal-db" (include "trebuchet.fullname" .) | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 CNPG read-write service name (CNPG auto-creates <cluster>-rw).
 */}}
-{{- define "hightower.cnpg.serviceName" -}}
-{{- printf "%s-rw" (include "hightower.cnpg.fullname" .) }}
+{{- define "trebuchet.cnpg.serviceName" -}}
+{{- printf "%s-rw" (include "trebuchet.cnpg.fullname" .) }}
 {{- end }}
 
 {{/*
 Service account name for the API.
 */}}
-{{- define "hightower.serviceAccountName" -}}
+{{- define "trebuchet.serviceAccountName" -}}
 {{- if .Values.api.serviceAccount.name }}
 {{- .Values.api.serviceAccount.name }}
 {{- else }}
-{{- include "hightower.api.fullname" . }}
+{{- include "trebuchet.api.fullname" . }}
 {{- end }}
 {{- end }}
 
 {{/*
 Postgres seeds host — use override or default to CNPG service.
 */}}
-{{- define "hightower.temporal.postgresSeeds" -}}
+{{- define "trebuchet.temporal.postgresSeeds" -}}
 {{- if .Values.temporal.db.host }}
 {{- .Values.temporal.db.host }}
 {{- else }}
-{{- include "hightower.cnpg.serviceName" . }}
+{{- include "trebuchet.cnpg.serviceName" . }}
 {{- end }}
 {{- end }}

charts/trebuchet/templates/api-deployment.yaml

@@ -1,21 +1,21 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "hightower.api.fullname" . }}
+  name: {{ include "trebuchet.api.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
-    {{- include "hightower.api.selectorLabels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
+    {{- include "trebuchet.api.selectorLabels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.api.replicaCount }}
   selector:
     matchLabels:
-      {{- include "hightower.api.selectorLabels" . | nindent 6 }}
+      {{- include "trebuchet.api.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        {{- include "hightower.api.selectorLabels" . | nindent 8 }}
+        {{- include "trebuchet.api.selectorLabels" . | nindent 8 }}
     spec:
-      serviceAccountName: {{ include "hightower.serviceAccountName" . }}
+      serviceAccountName: {{ include "trebuchet.serviceAccountName" . }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -29,7 +29,7 @@ spec:
               name: http
           env:
             - name: TEMPORAL_ADDRESS
-              value: "{{ include "hightower.temporal.serviceName" . }}:{{ .Values.temporal.ports.grpc }}"
+              value: "{{ include "trebuchet.temporal.serviceName" . }}:{{ .Values.temporal.ports.grpc }}"
             - name: WORKER_IMAGE
               value: {{ .Values.api.workerImage }}
             - name: K8S_NAMESPACE
@@ -59,4 +59,4 @@ spec:
       volumes:
         - name: workspaces
           persistentVolumeClaim:
-            claimName: {{ include "hightower.fullname" . }}-workspaces
+            claimName: {{ include "trebuchet.fullname" . }}-workspaces

charts/trebuchet/templates/api-role.yaml

@@ -1,9 +1,9 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ include "hightower.api.fullname" . }}
+  name: {{ include "trebuchet.api.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 rules:
   - apiGroups: ["batch"]
     resources: ["jobs"]

charts/trebuchet/templates/api-rolebinding.yaml

@@ -1,14 +1,14 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ include "hightower.api.fullname" . }}
+  name: {{ include "trebuchet.api.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 subjects:
   - kind: ServiceAccount
-    name: {{ include "hightower.serviceAccountName" . }}
+    name: {{ include "trebuchet.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: Role
-  name: {{ include "hightower.api.fullname" . }}
+  name: {{ include "trebuchet.api.fullname" . }}
   apiGroup: rbac.authorization.k8s.io

charts/trebuchet/templates/api-service.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "hightower.api.fullname" . }}
+  name: {{ include "trebuchet.api.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 spec:
   selector:
-    {{- include "hightower.api.selectorLabels" . | nindent 4 }}
+    {{- include "trebuchet.api.selectorLabels" . | nindent 4 }}
   ports:
     - name: http
       port: {{ .Values.api.port }}

charts/trebuchet/templates/api-serviceaccount.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "hightower.serviceAccountName" . }}
+  name: {{ include "trebuchet.serviceAccountName" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 {{- end }}

charts/trebuchet/templates/router-configmap.yaml

@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "hightower.router.fullname" . }}-config
+  name: {{ include "trebuchet.router.fullname" . }}-config
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 data:
   router-config.json: {{ .Values.router.config | toJson | quote }}
 {{- end }}

charts/trebuchet/templates/router-deployment.yaml

@@ -2,19 +2,19 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "hightower.router.fullname" . }}
+  name: {{ include "trebuchet.router.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
-    {{- include "hightower.router.selectorLabels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
+    {{- include "trebuchet.router.selectorLabels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.router.replicaCount }}
   selector:
     matchLabels:
-      {{- include "hightower.router.selectorLabels" . | nindent 6 }}
+      {{- include "trebuchet.router.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        {{- include "hightower.router.selectorLabels" . | nindent 8 }}
+        {{- include "trebuchet.router.selectorLabels" . | nindent 8 }}
     spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
@@ -62,5 +62,5 @@ spec:
       volumes:
         - name: config
           configMap:
-            name: {{ include "hightower.router.fullname" . }}-config
+            name: {{ include "trebuchet.router.fullname" . }}-config
 {{- end }}

charts/trebuchet/templates/router-service.yaml

@@ -2,12 +2,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "hightower.router.fullname" . }}
+  name: {{ include "trebuchet.router.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 spec:
   selector:
-    {{- include "hightower.router.selectorLabels" . | nindent 4 }}
+    {{- include "trebuchet.router.selectorLabels" . | nindent 4 }}
   ports:
     - port: {{ .Values.router.port }}
       targetPort: {{ .Values.router.port }}

charts/trebuchet/templates/temporal-cnpg-cluster.yaml

@@ -2,9 +2,9 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: {{ include "hightower.cnpg.fullname" . }}
+  name: {{ include "trebuchet.cnpg.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 spec:
   instances: {{ .Values.cnpg.instances }}
   storage:

charts/trebuchet/templates/temporal-deployment.yaml

@@ -1,19 +1,19 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "hightower.temporal.fullname" . }}
+  name: {{ include "trebuchet.temporal.fullname" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
-    {{- include "hightower.temporal.selectorLabels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
+    {{- include "trebuchet.temporal.selectorLabels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.temporal.replicaCount }}
   selector:
     matchLabels:
-      {{- include "hightower.temporal.selectorLabels" . | nindent 6 }}
+      {{- include "trebuchet.temporal.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        {{- include "hightower.temporal.selectorLabels" . | nindent 8 }}
+        {{- include "trebuchet.temporal.selectorLabels" . | nindent 8 }}
     spec:
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
@@ -34,7 +34,7 @@ spec:
             - name: DB_PORT
               value: {{ .Values.temporal.db.port | quote }}
             - name: POSTGRES_SEEDS
-              value: {{ include "hightower.temporal.postgresSeeds" . }}
+              value: {{ include "trebuchet.temporal.postgresSeeds" . }}
             - name: DBNAME
               value: {{ .Values.temporal.db.name }}
             - name: VISIBILITY_DBNAME

charts/trebuchet/templates/temporal-service.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "hightower.temporal.serviceName" . }}
+  name: {{ include "trebuchet.temporal.serviceName" . }}
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
 spec:
   selector:
-    {{- include "hightower.temporal.selectorLabels" . | nindent 4 }}
+    {{- include "trebuchet.temporal.selectorLabels" . | nindent 4 }}
   ports:
     - name: grpc
       port: {{ .Values.temporal.ports.grpc }}

charts/trebuchet/templates/workspaces-pvc.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "hightower.fullname" . }}-workspaces
+  name: {{ include "trebuchet.fullname" . }}-workspaces
   labels:
-    {{- include "hightower.labels" . | nindent 4 }}
+    {{- include "trebuchet.labels" . | nindent 4 }}
   {{- if .Values.workspaces.retain }}
   annotations:
     helm.sh/resource-policy: keep

charts/trebuchet/values.yaml

@@ -4,8 +4,8 @@ imagePullSecrets: []
 
 # Externally-managed secrets (chart never creates these)
 secrets:
-  credentials: hightower-credentials
-  temporalDbApp: hightower-temporal-db-app
+  credentials: trebuchet-credentials
+  temporalDbApp: trebuchet-temporal-db-app
 
 # Shared workspaces PVC
 workspaces: