feat(helm): add Helm chart and build tooling

[STRRL]

Add comprehensive Helm chart for deploying supabase-operator with:

• Complete RBAC setup (ClusterRole, ServiceAccount, bindings)
• Leader election and metrics collection support
• Configurable deployment with values.yaml
• CRD bundled in chart for self-contained installation

Add build tooling in hack/ directory:

• build-image.sh: BuildKit-enabled image builder with auto-tagging
• commit-hash.sh: Git commit hash helper for versioning
• install-setup-envtest.sh: envtest setup automation
• update-kubernetes-library.sh: Kubernetes dependency updater

Update Makefile with 'image' target for streamlined builds. Update README.md with Helm installation and image build instructions.

[STRRL]

@claude PTAL

[Copilot]

Pull Request Overview

This PR adds comprehensive Helm chart support and build tooling for deploying the supabase-operator to Kubernetes. It introduces a self-contained Helm chart with RBAC, CRDs, and configurable deployment options, along with helper scripts for building container images and managing dependencies.

Key changes:

• New Helm chart with full RBAC setup, deployment templates, and bundled CRD
• Build automation scripts for image building, commit hashing, and dependency updates
• Updated README with Helm installation and image build instructions

Reviewed Changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
image/supabase-operator/Dockerfile	Multi-stage Docker build for the operator binary
helm/supabase-operator/Chart.yaml	Helm chart metadata and versioning
helm/supabase-operator/values.yaml	Default configuration values for Helm deployment
helm/supabase-operator/templates/*.yaml	Kubernetes resource templates (Deployment, RBAC, Services)
helm/supabase-operator/templates/_helpers.tpl	Helm template helper functions
helm/supabase-operator/crds/*.yaml	CustomResourceDefinition for SupabaseProject
hack/*.sh	Build and dependency management scripts
Makefile	Added 'image' target for streamlined builds
README.md	Documentation for Helm and image building

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Line 8 contains trailing whitespace after 'fi'. While this doesn't affect functionality, it's inconsistent with shell script best practices and can cause issues with some linters or formatters.

Suggested change

	fi
	fi

[STRRL]

good catch!

[STRRL]

@claude review this pr please

[claude]

Claude Code is working…

I'll analyze this and get back to you.

View job run

[STRRL]

@claude review pls

[claude]

Claude finished @STRRL's task —— View job

---

PR Review

• Gather context and understand PR changes
• Review Helm chart templates and configuration
• Review build scripts in hack/
• Review Dockerfile and Makefile changes
• Provide comprehensive review feedback

---

Overall: Good PR ✅ - Well-structured Helm chart and build tooling. A few items to address:

Issues

1. Dockerfile: Invalid Go version (image/supabase-operator/Dockerfile:2)

   FROM golang:1.25 AS builder

   Go 1.25 doesn't exist. Should be golang:1.22 or golang:1.23 based on project requirements (Go 1.22+ per CLAUDE.md).

2. Trailing whitespace (hack/commit-hash.sh:8) - Already caught by Copilot.

3. Shell variable quoting (hack/commit-hash.sh:10)

   echo $HASH

   Should be echo "$HASH" for safety.

4. Shell variable quoting (hack/build-image.sh:5)

   DIR=$(dirname $0)

   Should be DIR=$(dirname "$0").

Suggestions

5. Consider adding --load flag (hack/build-image.sh:13)
   When using BuildKit, adding --load ensures the image is loaded into the local Docker daemon explicitly.

6. Missing NOTES.txt - Consider adding helm/supabase-operator/templates/NOTES.txt to show post-install instructions.

7. Chart.yaml version sync - Consider documenting how appVersion in Chart.yaml should stay in sync with actual releases.

Positive Notes

• Good security defaults in values.yaml (runAsNonRoot, readOnlyRootFilesystem, drop ALL capabilities)
• Proper use of distroless base image
• Well-structured RBAC with least-privilege permissions
• Good separation of helper cluster roles
• Comprehensive template helpers