feat(ledger-ui): add ledger-ui chart and wire it into cloudprem

[reslene]

Nouveau chart ledger-ui pour déployer l'appli Next.js apps/ledger du monorepo platform-ui en staging. Patterné sur le chart console-v3.

Coordination :

• platform-ui : formancehq/platform-ui feat/ledger_app_deploy (matrix + ArgoCD deploy)
• infra : formancehq/infra feat/deploy-ledger-ui-staging (app ArgoCD + terragrunt)

Contenu

• charts/ledger-ui/ : chart isolé (Chart.yaml, values.yaml, templates, Earthfile, README, _helpers.tpl).
  • Deployment sur port 3000, healthcheck /_info, pnpm run start:prod (route par le shim du Dockerfile prod-next → node server.js).
  • Migration Job (node dist/migrate.cjs) avec sa ServiceAccount (IRSA compatible).
  • HPA, Ingress (ALB TargetGroupBinding), PDB, Service.
  • Env vars injectées : NODE_ENV, DEBUG, POD_NAME, AUTHENTICATION_ENABLED, POSTGRES_*, COOKIE_*, MEMBERSHIP_*, API_STACK_URL, REDIRECT_URI, PORTAL_UI, LEDGER_UI, OTEL_*.
  • IAM DB (POSTGRES_AWS_ENABLE_IAM) gated par global.aws.iam.
• Intégration cloudprem : dépendance ajoutée dans Chart.yaml/Chart.lock, values.yaml du cloudprem étend ledger-ui.

Image

ghcr.io/formancehq/ledger-ui (⚠️ pas ledger — déjà utilisé par le backend Ledger v3 dans charts/regions/templates/ledger.yaml).

Scope

Staging uniquement. Base de données dédiée ledger_ui sur le cluster RDS staging (migrations Drizzle activées comme console-v3 / portal).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T17:03:49.819199Z	783b006	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[NumaryBot]

🛑 Changes requested — automated review

The default migration Job lifecycle prevents normal chart upgrades when its pod specification changes.

[NumaryBot]

NumaryBot posted 1 new inline finding.

Summary: #428 (comment)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 783b006251

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[shipfox-ai]

This PR adds a new charts/ledger-ui application chart (patterned on console-v3) and wires it into charts/cloudprem. The chart itself is structurally sound: it implements the required Earthly targets, depends on core, and all referenced core helpers (core.hpa, core.ingress, core.podDisruptionBudget, aws.tgb.generics, core.postgres.uri/core.postgres.job.uri, core.serviceAccount, monitoring/sentry) exist and are fed by well-defined values; the deployment, probes, HPA, PDB, TGB and IRSA-compatible migration ServiceAccount all match the PR body. However, the documented release workflow was not completed: the Chart.lock cascade stops at cloudprem (the formance umbrella was never bumped or relocked), and none of the generated artifacts (README.md, values.schema.json) were refreshed, indicating just pre-commit was not run or its output was not committed. Recommendation: request changes — the cascade bump and generated-artifact refresh must land before merge; the remaining findings are comments-level.

Standards

1. [High] Cascade rule not completed — formance never bumped or relocked. charts/cloudprem/Chart.lock changed (adds ledger-ui 0.1.0, digest 54cae07c…) and charts/cloudprem/Chart.yaml was bumped 5.2.0 → 5.3.0, but charts/formance/Chart.yaml is still at 2.6.0 and charts/formance/Chart.lock still pins cloudprem 5.2.0 (digest 4d32fdb9…, generated 2026-09-07). Per CLAUDE.md ("The cascade rule"), every Chart.lock change must bump the owning chart and every dependent up to formance. Impact: consumers of the formance umbrella chart never receive the new cloudprem/ledger-ui dependency. Bump formance and re-run just pre-commit.

2. [Medium] Generated artifacts not refreshed — just pre-commit output not committed. CLAUDE.md steps 4/6 and CONTRIBUTING.md mandate the generated-README/schema pipeline. Concretely: root README.md:8 still lists Cloudprem at 5.2.0 and has no ledger-ui row; charts/cloudprem/README.md:4 badge still says Version: 5.2.0 while Chart.yaml is 5.3.0; and charts/ledger-ui/values.schema.json is missing while all nine existing charts commit one (it is regenerated by just helm-schema / the +schema Earthly target). Run just pre-commit and commit the resulting README/schema/lock diffs.

3. [Medium] Leaf-chart appVersion not pinned — default deploys track :latest. charts/ledger-ui/Chart.yaml:38 sets appVersion: "latest", but CLAUDE.md requires the leaf chart's appVersion to be the exact upstream tag with the v prefix (all other leaves pin it: console-v3/portal v3.2.0, agent v2.12.0, membership v2.5.0). Because deployment.yaml renders image.tag | default .Chart.AppVersion, any install that does not set image.tag pulls the mutable ghcr.io/formancehq/ledger-ui:latest, making deployments non-reproducible and unpinnable for rollback. Pin it to the released upstream tag once one exists.

4. [Low] charts/ledger-ui/README.md is a hand-written stub, not generated output. CONTRIBUTING.md documents the per-chart README as helm-docs output via README_GENERATOR, and the chart's own Earthfile implements +readme; the committed file is 4 lines of prose (claiming it "is regenerated … by earthly +readme" — it wasn't). The +validate/+readme run will replace it; commit the generated version (a README.md.gotmpl can be added if a custom shape is wanted).

5. [Low] Copy-paste doc comments say "Console". charts/ledger-ui/values.yaml lines 198, 207, 210, 266, 269, 272, 275, 278, 281 (e.g. # -- Console resources, # -- Console readiness probe) are leftovers from console-v3. These feed helm-docs, so the generated README/schema docs will describe the wrong chart. Rename to "Ledger UI".

6. [Low] Dead NATS/publisher configuration. config.publisher (charts/ledger-ui/values.yaml:299) and the global.nats block are referenced by no template in the chart, and ledger-ui.env omits core.nats.env (which console-v3 includes). This mirrors console-v3's own (also unreferenced) config.publisher values, so it is patterned rather than novel, but as shipped it documents configuration that does nothing. Either wire core.nats.env in or drop the block.

(Missing trailing newlines in several small templates and the trailing whitespace in Earthfile are style-only and not material; not counted.)

Spec

Spec basis: the PR body (no linked issue file). Verified satisfied: port 3000 + /_info probes + pnpm run start:prod; HPA, Ingress (ALB TGB), PDB, Service; the full env-var list (NODE_ENV, AUTHENTICATION_ENABLED, API_STACK_URL, REDIRECT_URI, MEMBERSHIP_, COOKIE_, PORTAL_UI, LEDGER_UI in _helpers.tpl; DEBUG/POD_NAME via core.env.common; POSTGRES_* via core.postgres.uri; OTEL_* via core.monitoring); POSTGRES_AWS_ENABLE_IAM gated on global.aws.iam; image ghcr.io/formancehq/ledger-ui (not ledger); migration enabled by default (config.migration.enabled: true) like console-v3/portal; cloudprem dependency + lock + values extension. No material scope creep: the extra enabled: false key under cloudprem's global.platform.ledgerUi is required by the dependency condition, and the OAuth/redirect defaults mirror the console-v3 pattern the PR body explicitly claims.

1. [Medium] Migration Job command diverges from the spec. The PR body specifies node dist/migrate.cjs, but charts/ledger-ui/templates/job.yaml:38-41 runs pnpm / run / db:migrate. This matches the shipped console-v3 and portal charts exactly, so it is presumably correct if the image's package.json defines db:migrate — which cannot be verified in this repo (the image source lives in formancehq/platform-ui). If that script does not exist or does not invoke node dist/migrate.cjs, migrations never run in staging. Please confirm the alias, or run the command the PR names directly.

2. [Low] Dedicated ledger_ui database not reflected in chart defaults. No ledger_ui string exists anywhere in charts/ledger-ui; global.postgresql.auth.database defaults to formance (values.yaml:33). The PR body scopes a dedicated ledger_ui DB on the staging RDS cluster, presumably supplied by the infra/terragrunt branch, so this is likely out of chart scope — but as shipped the chart's defaults contradict the stated scope. Worth an explicit note (or an override default) so a bare install does not point at the wrong database.

3. [Low] Healthchecks only partially configurable. readinessProbe/livenessProbe are typed as bare {} maps in values.yaml:207/210, but deployment.yaml hardcodes the /_info path and port 3000 and reads only initialDelaySeconds. Any other value a user sets (path, port, thresholds) is silently ignored, which falls short of a configurable healthcheck. Either honor the full probe objects (toYaml) or reduce the documented values to the single knob actually supported.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.

[NumaryBot]

charts/cloudprem/values.yaml:98

🟠 [major] Register ledger-ui's OAuth client with Membership

The only parent-level ledger-ui configuration is enabled, scheme, and host; it provides no OAuth client registration. Enabling the integration therefore does not supply Membership with the ledger-ui client needed by the authenticated UI, causing the default login flow to fail.

Suggestion: Add global.platform.ledgerUi.oauth.client with the client ID, secret source, scopes, and redirect/logout URIs required by Membership, or configure the equivalent Membership static client.