From 1060841f6a0f2e7bf35d9d8e26c9b56c66542a22 Mon Sep 17 00:00:00 2001
From: Shriyansh Agnihotri <shriyansh@testzeus.com>
Date: Sat, 20 Sep 2025 15:19:46 +0530
Subject: [PATCH 01/28] Changes for TestZeus

---
 packages/trace-viewer/Dockerfile              |  25 +++++++++++++
 packages/trace-viewer/index.html              |   6 +--
 packages/trace-viewer/nginx.conf              |  35 ++++++++++++++++++
 packages/trace-viewer/package.json            |  10 +++++
 .../trace-viewer/public/manifest.webmanifest  |  12 ++++--
 .../public/testzeus-logo-light.png            | Bin 0 -> 6878 bytes
 .../trace-viewer/public/testzeus-logo.png     | Bin 0 -> 6754 bytes
 packages/trace-viewer/src/sw/main.ts          |   4 +-
 .../src/ui/networkResourceDetails.tsx         |   2 +-
 packages/trace-viewer/src/ui/uiModeView.tsx   |   4 +-
 .../trace-viewer/src/ui/workbenchLoader.tsx   |  12 +++---
 packages/trace-viewer/uiMode.html             |   4 +-
 12 files changed, 95 insertions(+), 19 deletions(-)
 create mode 100644 packages/trace-viewer/Dockerfile
 create mode 100644 packages/trace-viewer/nginx.conf
 create mode 100644 packages/trace-viewer/public/testzeus-logo-light.png
 create mode 100644 packages/trace-viewer/public/testzeus-logo.png
diff --git a/packages/trace-viewer/Dockerfile b/packages/trace-viewer/Dockerfile
new file mode 100644
index 0000000000000..f4731a7a20f11
--- /dev/null
+++ b/packages/trace-viewer/Dockerfile
@@ -0,0 +1,25 @@
+FROM node:20-alpine AS build
+WORKDIR /app
+
+# Copy entire monorepo to satisfy Vite aliases used by trace-viewer
+COPY . .
+
+# Install repo dependencies
+RUN npm ci
+
+# Build trace-viewer (service worker first, then app)
+WORKDIR /app/packages/trace-viewer
+RUN npx vite build -c ./vite.sw.config.ts
+RUN npx vite build -c ./vite.config.ts
+
+# Runtime image serving static assets with nginx
+FROM nginx:alpine
+
+# Copy build output to nginx web root
+COPY --from=build /app/packages/playwright-core/lib/vite/traceViewer /usr/share/nginx/html
+
+# Use hardened nginx config (path is relative to the build context root)
+COPY packages/trace-viewer/nginx.conf /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/packages/trace-viewer/index.html b/packages/trace-viewer/index.html
index a131ab208638c..f2750c27a0cc6 100644
--- a/packages/trace-viewer/index.html
+++ b/packages/trace-viewer/index.html
@@ -18,15 +18,15 @@
   <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <link rel="icon" href="/playwright-logo.svg" type="image/svg+xml">
+    <link rel="icon" href="/testzeus-logo.png" type="image/svg+xml">
     <link rel="manifest" href="/manifest.webmanifest">
-    <title>Playwright Trace Viewer</title>
+    <title>TestZeus Trace Viewer</title>
   </head>
   <body>
     <div id="root"></div>
     <script type="module" src="/src/index.tsx"></script>
     <dialog id="fallback-error">
-      <p>The Playwright Trace Viewer must be loaded over the <code>http://</code> or <code>https://</code> protocols.</p>
+      <p>The TestZeus Trace Viewer must be loaded over the <code>http://</code> or <code>https://</code> protocols.</p>
       <p>For more information, please see the <a href="https://aka.ms/playwright/trace-viewer-file-protocol">docs</a>.</p>
     </dialog>
     <script>
diff --git a/packages/trace-viewer/nginx.conf b/packages/trace-viewer/nginx.conf
new file mode 100644
index 0000000000000..3d88cf6f78d81
--- /dev/null
+++ b/packages/trace-viewer/nginx.conf
@@ -0,0 +1,35 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Quiet favicon requests instead of 404 noise
+    location = /favicon.ico {
+        access_log off;
+        log_not_found off;
+        return 204;
+    }
+
+    # Block access to dotfiles
+    location ~ /\.(?!well-known)(.*)$ {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Quiet common scanner/dev-only paths
+    location ~* ^/(?:@vite|actutor|actuator|\.env|\.git|\.vscode) {
+        return 404;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Static files and SPA fallback for known entry points
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+
+
diff --git a/packages/trace-viewer/package.json b/packages/trace-viewer/package.json
index 699014a40fc7a..b697543f4fef2 100644
--- a/packages/trace-viewer/package.json
+++ b/packages/trace-viewer/package.json
@@ -3,6 +3,16 @@
   "private": true,
   "version": "0.0.0",
   "type": "module",
+  "scripts": {
+    "dev": "vite dev -c ./vite.config.ts --port 5173 --strictPort",
+    "build:sw": "vite build -c ./vite.sw.config.ts",
+    "build": "npm run build:sw && vite build -c ./vite.config.ts",
+    "preview": "vite preview -c ./vite.config.ts --port 4173 --strictPort",
+    "test:smoke": "node -e \"const http=require('http');http.get('http://localhost:4173/',res=>{let d='';res.on('data',c=>d+=c);res.on('end',()=>{if(!d.includes('TestZeus Trace Viewer')){console.error('Smoke failed');process.exit(1);}console.log('OK');})}).on('error',e=>{console.error(e);process.exit(1);});\"",
+    "docker:build": "docker build -f ./Dockerfile -t trace-viewer:local ../..",
+    "docker:run": "docker run --rm -p 8080:80 trace-viewer:local",
+    "docker:up": "npm run docker:build && npm run docker:run"
+  },
   "dependencies": {
     "idb-keyval": "^6.2.2",
     "yaml": "^2.6.0"
diff --git a/packages/trace-viewer/public/manifest.webmanifest b/packages/trace-viewer/public/manifest.webmanifest
index f823692c3156a..3249fbb3b462c 100644
--- a/packages/trace-viewer/public/manifest.webmanifest
+++ b/packages/trace-viewer/public/manifest.webmanifest
@@ -3,13 +3,19 @@
     "background_color": "#fff",
     "display": "standalone",
     "start_url": "index.html",
-    "name": "Playwright Trace Viewer",
+    "name": "TestZeus Trace Viewer",
     "short_name": "Trace Viewer",
     "icons": [
         {
-            "src": "playwright-logo.svg",
+            "src": "testzeus-logo.png",
             "sizes": "48x48 72x72 96x96 128x128 150x150 256x256 512x512 1024x1024",
-            "type": "image/svg+xml",
+            "type": "image/png",
+            "purpose": "any"
+        },
+        {
+            "src": "testzeus-logo-light.png",
+            "sizes": "48x48 72x72 96x96 128x128 150x150 256x256 512x512 1024x1024",
+            "type": "image/png",
             "purpose": "any"
         }
     ]
diff --git a/packages/trace-viewer/public/testzeus-logo-light.png b/packages/trace-viewer/public/testzeus-logo-light.png
new file mode 100644
index 0000000000000000000000000000000000000000..fab5bf9b11feb4ff6c1b7582eeca9d6c6bb31882
GIT binary patch
literal 6878
zcmd^Ei$Bxt`zI<=ldlS^QR$l=3PseAl`JKsGRY~A(46M5C8tT$D(7#H#KM*yLMY53
z$H<|ut!6pRv21H{YG$^vez)iM`~4N)y<U55yFT~fy07bfy|3%K_vn)SxoumZTV!Np
zww<>*ds#+Cc4_^sun9<dzK%ZzABrJ1F5xmVN~-H`S(%*Y>Od$Pe)-%PnR4o$AK-_)
z-)XzkGBR(|lvceq%E&;&&!0Vg^^WZ9sCyV}0B5kkG@N%Wk2!WvDYbP;VQcE%@7}uB
zTlU0%P?6sw+o7@@Qqhxk7P+?<v82$iaT?O|@revJO3Qdh`i78ZaX`dxyi?K5^VKf;
znoBK0kAV4|vS7>ql9$|}4L6jN(wI}cmZ^ppkLMZVUmY^}Q;v<-rQwd7=)2<~Kc|IS
zC0YfK3o4|Gl`HP%?o!*uKkj<$k#9|H7F}AKfqCT}p4xA}ft!NZe7kZb0Cx>jmCq8+
zmnN*l$u1#Da%RQ&M_O89A<hD$fxyVa-%yyS=ns=Qp3Ai|QQGwQvezU2Ez{<A#}u$P
z^k!;?F>j|K7XRY5cABvKTb7k4yP-?nC$TrQla!f`PC<=u1Iw1fnw#mn^{_X}u)E!0
z?0M5QfwhW{OcR(C^&5uqW|S=lz*%I!4X``(sqvC;Jl)h<(fnDT`;b^wZfnyQ6^ibZ
zr?>0<2Pe2h#OApO4Ppdkys#Y>r9+Q5o2_QzgX&{EP9#7qz-Y|RMy6&dB%(B2{VrlN
zzTn+8n4?+pC^v*4tAL$Q8jpF^+~C(K^2OG*@0Euylpfhs!J<7i+j@p1*W$ma;_#nZ
zaF*Bh4X|rN{tKVhz$k<~oK8hWg9Y{}Vs8*NI5XgDyaM)F{nMJ^iXS0__u%{6nwsG_
zpB~sIZMs(>%7{7wOav7C=V!T8b2f<L$(V%5{fld81<X>le@b#I0}`SBwZJaU%gKo#
ztLn7FTEplqwDFg1W6E-0W&3DVMtP7pX7~g>Ku5qCx%=Z}sU^)@U*C1yzr|!6B7CwC
z_|moGV9PDy5#bYY!Ku#vzXTko-Vd5a)B)oB(`a4yL#BpxDRNCNzgm=@rB+JK%UVXN
z?l_Kuvm<?nC&yyqzCau_3`s%6DZD}{w(y(ixj!ct=t;y8qWKmV$aA9Z8#P;&*mg@e
zgw$hToHO+L5F?pStr@l=M1P6NH`hXsbQ(Nz)p9LusV)+DQssUL3Z<IAw;O#H2Zcn0
z6QWneF)^z2ycFBfhCD0b{eL^p^9Xb2du?zk^WNhcoPao0!MELgLfaOVphLBh9<w{R
z0!)Y|>c@ATphtNhl3#DCxEi{{y=q!|U#yW0AE(JJS2-#A6;uU9p!Kh;oZPGI;}%h!
zbyT%)<FTgI<Xyi_rJpGko+bGiXy@-m+;Wu+v{_lcvn#B4RK#=c8tk^&lH+ne@{4#P
zQ&Qi)2C-9JWY9&_;2Qm)`RFXk`IX9J_zLzeb{X}Arxii677X)C2x=Uf&Zan%Ofe+X
zk7O6|`x8kTKZ;A&Oki`$x1v(__<3J(J>E82Bdn&dP4(qE{cgi%&!@T0_F=f3xLo$L
zmmSK)LD3Eu*Kb$+!qrTMPGI0Eet*--mOY2U#%=hq&zZq0u4Vyq#|A%A-RC?@OLWV&
zq;7cN+_{xFu}iC@poABR(}c5X$^6{on)7^?f582`y1)lV4|%70<)yxIDpk5EE^Log
zs)djD+%;$#64o=XlT1^z;vni@8#k4+xVINRHDT*8w7qI`m%ipR2CoqHmcAc|Ij=!|
zz5W>6DT;!#B5tHBc}6li&%9(JB8Ilg<uF?_cjwYhc%CCjs9VFxi|Bl0-N>*9S;x1K
zQCoFV)4^5aR_U5^4NLeX29v4FDWfD2t}A1W7(ZMzj4Vt}E}$e7C4>1RHeExF>U|6}
z(ZaF}<|@hY4qPH7Yuv8Z>6^%0GP<qa?t;g=ta`tx^&Mo=<MNhDlb_~$x(C*eU)ue`
zwrWpZSV49uUS00X<X9d%IxxMbu@Nm1F<nT+Z2K+`+VS2N(WTgdo@73*d@7s{O>p!5
zJFrw`u14RP`$*60M;lQeuO4RD3jDp(V{pVby(iE-1%icgQ{R4$cY(Oof9~&7JG!Zc
zW#*OM^F8-ArD0I8#p0wQZr|`CI#td&c<Zq{)BE5oGe!)JmQeghLA$h)DmU7Ty?(hf
zc_yh~*uSO5tvP4BEXKliTzKr+e<IwMrAu$mm>T8A_Pr~x_z~MFg2Gu15drB*x#{Rb
z4b6R(SqRLnbZ=+=p1LpUqp0W??M-U6sZ|**R3a=|3EMR|_?gIVFtSZ*x$1zdVdCuw
z(U`4a*@^uM5xZbB;r}>4s4+YIoMg(I@=E`kcXGxNp~rDoN?yK*H%%)aK!DAU^hQiv
z_{N(*+FZ808_tUMOSi4L-l8&hDtB}mpU<XF<^Oru53Ny9DP4Vw-jee-b0YJa`#k(Y
zzUQtcOS5YhmW*(t<2I)h!_uLXn&%wEV_^UkGk=ASem*sBs1?;Ig4c{}W~{oMpgv9W
z=sA$~r+Tp_R+GUu=@hY_+pGVTK?tM5X7#K9fC}m!|5n)a1b>Q`8O4jSOh!w}rRGU7
zxy!NEg1zx$jXrr@ANnnCdb>O2(M}yOI{FyUs|#8AwJ1{G`$f)|pN`+lga<pvYFY6O
zDfrU0&Ui#o_z%ur&Z$yUtHUqk;mIA{wZm~ZGTt_V$BZ2IwM>o440T7%<st|wHbzvV
zL4VIsf*CA&cVx8D)hiVULVQZdKeWyuN8$3IlMrpsd~tAMgB_{8wIqod6ynmagsWp@
z7OLnA7rPVe6L)Y8Nx(k3rM72Y(|=shv^XF%gNcnZz)CkMOuQ9X{1%GSl~HjF88Xle
zq{%^mV6k<KlvVt$<|W^)5wQwb_0~gv&oKysSx~7n7%N0YpS-Ef3fcgRdOE$1f!wFZ
zU1z_wT>RnX;C(<IzI5yOH}kHtW%{JOj&U2shGdn7wD=Zdp@+R*pi&+Srd6(7g6%w+
zU&WlXZwSLAMw`}<oq_lbwDEF>q&piDas5~ZvhMU;K-@zF;na5kV_7&0-F_B2>CvU2
zh~-{8XhhX2Y|mZ(j`xiAPc%zX`4^W?4)lFqL2l1Ax%j<#*%7eXK|0x1b<iJkjm&tE
zmQm}-Qi#xshrqHwpd{O1b3cpGi9P7;p9d~$v(6_!Ll7VreE=uGSwmJZHrhO7&QiHx
z)W2mPoh--f;5{7nx|j%wST??otYfI3jE5YNu&o5{fZ(ryEiH^wLUb}}KUYvy!4r^%
zljqtV#d1UZ9ELEIw0e~}6CnPCTlfS;aeux<Cz=5_3v`HTSRnq0>l9rFyN>QaaeBHF
z5rkbg&A!E`0?FwnIBjjC(3}9sOCDZ*<Av+29uR+BH-ojWJp3oR(slL`B;xiH2};66
z76hLmwQGXpUG$C#ICm%ySvRSG9sCR;ts4(`62%SdIZ6SUfABMNT*v6nG=B49zU=NC
zgtl9@D{!YZJxAR099oe2XN)FC+<6jJ`d;s-h$;H5d$|kKbiL(qOUL{a<CmxLr^UYu
zRpyGsRS#o))?UZ#XhoqCoblQ8iA=kzp;t%U{Gv4$C2^&R=AO2eswW8|^qdl~`$!Ho
znZL$@{mL&9ho_%umd^aL4%NKq(FBj%B{FUE3H6j%1=iPgKb0)?1(!B$JA?nl^BbpS
z2yN#|p9gSE<)f11#nk|4KWHn4gK6pc$>RDfWC7be{m}6?i&Vuo(-2}Mb1Y9cZ-=1h
zos?EHW5hIWi`9yZ)>Pd`_mV?*M&dGYDIu$gF{xp3AMH{?o}k&)(_{Nx=NSEg6b^om
zAG~>sXoUdh=5vfx0(5hjB3eepQm*LRUwJ7g?i=J4Q#H2tBJ;v2sYeCd@+wDQDG{z%
zhSse58B|z&jNR+_R7kP>U>CY@_q?)4_J6R6`cpw`zXW{K-z`!3x1H`$jfE5~Wb-=S
zE+!)g(H8*~CGK<%ZQQavlXdj^*FcJ2oM-gK^z}!PouWN2v))GONp(sEU+u^$bH)d4
zNbRsdio@9w%7B6InI>2tZ}r44laI{E{q#w_nqeKzn|BY>(5#?06|9J|N?6J}#dt{V
zYv1Q1{`q-Pf8zz?M!R1zj-`Zr)1gm3b?H5kUp%GT>>2Ya^<EhWg#-iv88xUT^7Q^F
zSF&n_KJ=q`xxIT}=<4ptU{&t+zMzoIKm4CKcVsw;ZyyZvl*~MnjfXsXuU8f7)KUB1
z<P>u3V1za+Rvunen-dzm@F}q0C)4jeG6z|w1K8!4=Ipzj@zmF4HN#9Nj_=z$^KN1|
z?pcvHe#o?~4{ex<@EZ%H&=~W`lRHBL0Vn8j=n4@;gkMb{rF|4E@}zr&@k}G0dU(h`
zzy4EsFBGGVDGCQEY#%*a$90yE`f#l73PT|){M!u;qq?(f{SCP;CAGt8_e8oV<=8nu
zh*vh`4!Oj<`ojBW_^d)H9-jpmR6=F`gsz{jH;pM`W%f9C6iq0pq7$PvjSkYYb9sBE
z+j~(vLp53d7M3mdE11rx9gnB}+yQ^?H#-rQx9y5D8akP(?OFUWbUChk1MFGKi-%QF
z4NY5{pGtT!CIAj+Npk$qqiMyiBhPGr-}ln9$@`7Z_FZ!KkMzb#|9+H=bUK4pz_K~I
zQtfBNs_9x(XoO8E-}?IumfF?d43x-EIHAOTd00P)5?AJtTO?6W)yAMWwF+2YKhcX5
zX`h(+;f@4Rxa(}hr?uwgp|N$6qaNO=GJo%50FNDYu=#QYwa5@EIIwaL;g?rFMX1x9
zYCY?Oi**`Ztu=15%R=})<vER19-4A8befKTCyEWTEW8Z@JQ&#P0%a*`X4ER~9`Buq
zvGiqE4A~>s^3m$<$<^L5E0R$_PgaL=F%^0d8Fii^A5oE(VVV-6yq(+YQBw7FUwX}W
z&)xu>#<Y9Xc_n;7eZ`vLFDFpMO?Yg8{YklOX*W_W@L!{yF8@^5jbHWC0bXX!2h_qn
ztw>hdL5#1Zf^YCat%3K_@(}Al`=>m%@~0-1xhKdv!DG^Kf$Kt=z;m6eqN_&xred2a
zBX>AVl}N)a9$Gp%nJXf7GB1A7w_Vr`qJ+~;^c&oyxiO@ouwFM7HPG=@w&m6asS9i&
z?v<SMka~Yfu=LC`%ZaY;kz&K~<egDTujw50A{j3B-<Z#Tlf?Q9lon|TX2(-P=CwV2
z)*^W#iiRF`kiiRHdB`WWR5&j>OhuHcHCQ^m-Lle7QbKb-F(&MxlkBc7P1Yzb>u<#s
z9Y+k!*?RR4`53+aJ}s1G+LwjQ=M{JCgp`rkp?e5S2EtFZ7CIZuTY%2iR72lQ<t;~}
z6Nx(UWBcQ&`Z>r3BD@jVfP1{MB(h%Yn(z=*af=?l_S|tr`?-sf>t!oK{Bge`S`O_o
zvLQON!`fVV4zS<!9=6Z3!Wvb*rCly$My6A%=jLetYO}}Ln_?V4FbWkj%=&4hr6vG4
z5a~1G$Z7EyOkru4B368P^J-Ppbe@EiQuc~i;cS_3*;#V_yR9}$Gq7H+z`3HAmSu2X
zWc5#A5<kC+4#_h6{_0`eW08%Ov$0K?(B#)s=p^-Ct|GSk67G1u{mRs_JR(N=2H?u&
zyPY;GPab~LcX5FEmFLyl3d~<(C<wMNZ6iN`42gU+OZg>Z_tsu32A6^HhQBhQllJ$T
zT*y|z5Y#}Iy?bN`TIqJ~BjYwvc<>_xp|_We&wEh*iikPzPn1SLtIv?EknBsA2Kzmf
z_yVBhw{9XcGO3@wPe-*Pzk<g$82wkxzLb!d_gi3L$7cDQ;^4VIGqznMtCUOcga%|I
z2+0@k^z$l<i3SOqf!9ycPC9(yvGQ>}K<z&lvvlu^ye?jHH;pR@Zhl)0r$wHi>7;~=
zUa}&%x!H%~Ja#Mwi_VP3s0w)Iqnjf3L>ftJv{BsjB=lEW54<;g{L~y{$6SCxg1rK^
z`-40!KdU%cGw`KHZk!s(geMEX?u&<LTw~IbUe6S^kb|4+6_2-Np7xW6f1e1uUdm_E
zGqa!tHHP;k!ww1dz{01Gk|iTaE7itWA8)YbaVyPpV}GHd_R{yssg~qtb==qI9EnYC
zL?_MwYh}0s#xJ~VX|P3DjrqTze1NP2w;}2ck64h}5@O3C>b(?D(bSI*NU6L=%MCDO
zc}}Z{ALWBD4{oOXVcb@4`0CsSSm&IsWM`Cy+M@2@wJNw}YNJLq!zdo2ZE{~68LB~J
z_SG(Xe?M}(?T?D3i=_5vK4YWJU~%138+Q{y&GAAdSO%>88s05l6=lB@-9Gq5frG3A
z^@)0w?#RxlcSY{oaM4$8C7LO20{QzTO2EJPH(8Iz9?7=ReqOdLtB6%EExof#!=K0Y
zc~kZWsP3R!k)(DTrhspG*0)4V2Ff<A7sB5jp*V7?T*EU-LgxN<abzS3oC4m<czZS_
z<R_?{)h#{+Q)&Wv?4BF0<JM9kr9mZF9@OTJz5@RK{=SIM#%;N0$AJHnSPDQp@^fmw
znsuXVGuBU-I))sh9&bw_0K1}joch4}tRA%v;rp)ubB7&{v8Ga`Dk@w<le9|o16O8W
zg1bh_g;KDz-9cgP0FFPvV>c8#bB4wh)S#2dbENj}@0Tn+-8K1_XR&Ik{)u`Cj$row
zq?WJBlEnd<ZC2OM^+W_Jh!f!SPm&f1_3uP;|BG+S-x=U~=AiZJmE>!VuZZ)12$`bd
zvgJh}+|PViJK~Jvt97`%c>=<wz9RO6=0?LU#dwdkV^l<iGn><s1ysqg(RPc<HVc%t
z(3>1a##(jgUWf4-v!RsA^4SK&P0M-=MQ7YpOPmq4lUge>7z`u4RsRu6iNZ-QjK)L=
z9-FL#oqiNRz%gavOm<-~Uh}86P%``xRJAJCaxJwy+xxTmYza7WeH!xL+5kc~Vg!8b
z*edQ#Rbk}CzU*}rCS)*ajOn91c686$GiWw2zy|M<^`LEwF#za>S(-z*>;20SX=T)k
zR;R*Ml_DOyY(<?8uxHh<r_bludKMeYkqj%#MIEGj-O{daX(}dSa7H^l{h^bEA&<6d
z0HeG)${P1bB<mgdtk88s9=`R~RssLT!-(~a_TB^3exa@4=4|Vau!Xs0tb^n{{ehO;
zrUP^@n+_6(28=aJSLjj)+S1cG0O=!SmDIP}xrXUZYmE=Bw~~s9`I~~kh(ln+rw{=@
zO!Ok8>yDCf+tGs?V4E&)3zwR2bB}~pccg?QKR^)3Zh|;z<Cwp*Dds#w!St!C6hUg=
zzJ7tyJi{p^>lr+*x`BaCsu!G-U8<NLnS8ub9fRgxNNU~&<|prjZzXZWkuGi@_@td6
z-5t1b6KGE6RkSyi6I(8uVwfX$*BhiNpq!4~=&JcGYledG@Qp;!s)1XzN$S(_5@PK|
z?L7tmrjz}crwxR)MSONe!q@)NaMQM<{-86fzT<gB{3?IIOX@b-XaSw<jt7021y5Qx
zyw2S#JE}jT%nEeqWC!O_ldDea4w(g}PL)I2gXWJX7HPdOn||-ps5tD4v)=`_eF>5c
z^xcc#v2sv^6@Gzjx``lJd1~U+*<RcW=eBz8+r0rM{_<J${~nR;%|Q_IuvlqhvQk&E
zOgyCN7LOBz8P_Mi6CJxdWORz+UfjMyJ9<iU#mZK|*S+pE&^P{y7%^8ZeZG0ABKe5o
z(ypEN_o=hAQ*48d($`~w$9Cr%+1UryTPc^^t{nlq+@gHfRUVEFTpZxN=~&nAm$6Lq
zemXfoZMKZc?2DHuV7b>z@@p3@pFAjUJZvvF0m+#nc{}Y^`?O=R7{Y%dQ%Bed$KG<X
z9RIDqP+9koBf9`pbr<{mW=1;J6~V4KkgT$n8|QFNrg4tXH?~6kLDw3~;|M;jx{dA`
z{0mIJN&9DGT^W-Dbh2J_KP{=}PI)jS5R^pDx6R}Jk3d^@_0!4P4FJH_&+$?en41UY
z-uU0d6j)?l=aw?DaS)hH-z~TW?qKEI-xu!=`sTK$fYIDE<$j(cS#7R48J7n*58z$)
z&1TSux`KprEpVmh%IGRi=I42m)rh{SN3OxTg=Ln3HbEV}|B#j`kBtC!st$Z2j&%HB
zh6^XzS<94x$~v_~7w^XJ`9w2F>XN1J*Tddoh({(-IKIp+kWo#Xlp|`*Fc7RY$%+V>
zT5XP_01H>1*mf79fW7q@G=q8fBr|ayJ3^a{u^YMRg(tYJQ&xh*musU{S}J}oW8lO8
gHUE=L)JiuSjo%rZSW<_t|1osl+Wu_$nH%^12g2MZWB>pF

literal 0
HcmV?d00001

diff --git a/packages/trace-viewer/public/testzeus-logo.png b/packages/trace-viewer/public/testzeus-logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..2c40e275df1ddc1407909760b23d6ca5de99d2ba
GIT binary patch
literal 6754
zcmd^Ei#yZp8+Uqhs3xfhBb44Z$Bxs;`CL+=rE*G+g~`wyrbSjQRLI#Va+s__m}7a7
z!<bmINQljtVouu}eh<Iv`u!8XUDvK{_w#-3=RSV!`+oN5!g<S`5^@p(0s=d&t;{Y7
z2na50zQwiyO6S*+$KXR8Y2_3wAh2C}^DQWlktGX=g29(8O$5ri6{f%s5pQE#V*!D8
ziQ8A*{}K?`zie%0>~L3*J?wl(fsvy2Gf9V0)?DWFF&XhQW3TLWY<p({#N?;M!LnTJ
z-lx|EM=kUst-B;*p(pC@x4V2y{?vyMdYbLzlx!?vv^Fu4%GH-TbZz%uiOdJ#)BNuC
zU=?uW|H&&?)JZ_WZK)=0cw=M5Kz$6yvg@=<nVvDPb6yXAAxhnkg(&<AOKnNK`0pGn
z8lAqT=AyN6s8&2z+EVas;fTw=4W3mR!YfGLTM%WDD;$x&R+*MMFyn2vwl?<nIzk{@
zirM7ym@wYPSjRZ^T-&zEaOQRhP4Vc+pU(AtM&2Uuw@J1Lw&eA#vu1AgIr4?ehVo2>
zpx@{(5bVlmiNsQ4oIVb6+cVTjL8j$vA!oHPX=Ygv)hZ7CR+O;~5yvg`kB)j_u4q&U
zm<>j^@V_mU)W2?q!quo)Z_4@`UCr5XRBE)E#9<UO!$>s8;mpg+W~;Ymj`Zykb(Ur}
z_08Vkmo4E?)us#)_@AQsGWxB~iRrH6OzKfAWVPc5g8hz#41?no#ZW&HkH6DY{W#we
zAz@6ck!ZvG_s%i?;n1u=OPt<<Nv?3?H}|=YzUwun+JF^)aV*72!Q{Uy>Ux?k=nSy!
zk&$Rdjh`fRmU<Z2;{AA}H25lwg-8!j9V2YP!xp*Cu_r@l>)R2tRCz$JqzC;N`rne-
z@Wz>pT0hbh5~nDRO3NMeoI8SFQI^YZhVm9~OuL?T?GkQ1(%9~yav6`nBrNyV`G!{W
zZ|D18!x;E0G2i)Rakbnc%Q^<8(;nBhlIXYk*hs_eg!l^e?~^j@I}@184gGDhnRSu%
z@sD)f+PGeQ^>;`%G95b?0{BLx#8oBXR#k0R?at+;gAGNBKzwz3Hj*@ANZV<rNPXp;
zIc5-R4<DZkx2fcO1(xia1&fxBMf}KoSnXfoYqkr{M!X*>zZvaWe-ojMH_nwf$Z`sA
z?HA|SYyY)FLCbAl=QHv1i35UDaP5&cr5h@8gl)^Z$A{Dx8RKZ9;160MzxfJem_{-0
z3Wk}}61%5r?jOi-P{W+-OUx>sw^lInQ0-T3qzhYy$)$wo79{1cY!)=sZdTqccsTBp
zslH5_fH^YwAx-X~M@AKn{S$C3k*6bp?zcrI`Cer)OX|Ji_#UW+;D`8m4$Ch!+HJ#V
zSyq0k$YgaQA5MSO3uR=cjjpHhI>$Sy+-^*$mcJ6bb4{bpX@5hN{dSH;SXN+e^V<H6
zyIDI!gBp6gzq(^xqJ=|jygzq`)qk*YE<~_TLT7u5BNFtxTR(*Q#YQmy_}^M=)RmOY
zX%DGD!0Y^6H@2^>209q3P5o&;wS;+GTD({+_e(ZoI;3zeABEnEjPJ!GiAiM58{UX%
zr)?3wYSc5Wt#5xF{ivN@-Z@r1PF%`>EIT{=?$rMoB%0!t0nbD1$aEK*Pjj>6`_0+B
zlRMA{q^Mo7WJD<bspOa%R%L8o;3cm!?qO_ijdsYewOr88A<Jj3{Q5+ixOgTEldERO
zOez1PR$!QPwR+y1sMiha8*PxpUtgi4rA4242@k*B&pTfHK;5;XVJoEh<)0tWDa!Fk
z$&*ngq;Kix2g+Wr+@;&tA=r(`2}~L<is*3KKYpj8p8=J9uJ9WA+`_x|91xFH4Rx^G
z@GOeVD_^qDd&Xh>hb|c!5<h-#38<H_)WIsLS3Gb$aa|)C-oEaQtmfWuS%3F?#EzU|
z*-UWtzg`oacgieNtp+)PUrgYj7p!m*F|6fx=30Gsek?E$5!irlJJ{hcn$8B>b1v#I
zP^2c2aDVd3uVaVM_CVZ9v<XR8{H%QU_Z4?5V@W(B=LPrE4_*BA*JGX)xx<^$K*{{|
zDMkBh2*+s$R(&}XYz>w1AJ+N+6wP`--bJZS9|P;*PIdDN&{=lz2xH*mw_m+CqMi8I
z0B<<uv&W~!7Gvkifft=s>C)k~CCd?tPukl~MMRTz^S-Bd=cx_%x=cm3aks&T^!_B8
zYXz9JDhEbnc*3wQeFxeaUe_Q!{gDXvUg+%bO56DDeA1#<+pN&A$L$$L<l2w){6W{p
zElnW#;6t?@&pKrt;*p5n_gZ$$z0F?VTDZx2bZ-LQDM*Ik@$h<07_p&bk(*w29`l>L
z6Q$QT_yZ+VRti8SE{wMR0J1#m^y_&Er_3gfO}P_obEbU7@W$UgUyhlfxxA6-*SXeL
zHC-Oj?hY99rVdW8m&dR;<-DO%xq~vs5+xSZBbJurhC8s^akleCdh|m1$*AADBmag(
zM6(Fn6Uz%;^&M-+Gc6q@$q934rRLSi>u21bTFTA;6IMZ5s2`7vnK4*D&a_+P9CdZb
z{>_oC`rSD|v>GrUP%Yt$FYvBShCHD}9__cESo~#rOe*GEPy;aM2#dhbZ!OWHC|c6t
zfj4H>JD_*_f0F2py1SVbWxUf?H9f4lMAKv=T%PQTBVRj!7U<g>dC|F?U_qWQ>g>pt
zX6gvg5;!7dbVL`j(DS#dKO^eoq6CULC?G@92MFz-p$&9H=TE<$wy4I5z!yrZoo!>z
zzH}*S&i>jTk1Qrx&W5Pw8{rh+>?7^5-YFhrQmE;>@Km4u@^|4Q@chAI;*vJ1x-X80
z!pKc^cnFj){RLmR>7&<O^|CoTG=I4q<fL*JZx@pqV?3)navu^V2XoD`pd;950tiuY
z6!XgSE&rc*)8MDHu2aCMe}V;1=K;C*km#m3y*E^`fdg0wRBj=GL&>80CRkLrf^DB?
z-s^T>!gOE8=}~OzrDn&eFI)h*31EU0LB$h3<lCVuHyWNku&#iGI9qwnbsPtBJ`6hX
zsU9!5n@N3d7Mf*f2R2(rxkS*!!uARuq~@8o&*+XA;q>BV+v=8#PkuTBXtt`=ey+hL
zh2jKN|Cltf<vm!4=KdB(z6^Zmw8OAi>KB!lfsXM=@1t%)(5pHxh)b?aBx4uHyi!qj
zk%0T?QW>pG&HJl`&627_KZ%8eK~BV3RO4lJv5=ko&Ai<cq~MX)oNWrs?fvY-M?$x{
z5LB+hrS4cYRvJeg?Z$p-^ix8r4uM8OE}1o!vNMZ1Xg4et2F%@wIOa<I3x47t4a$(8
zLV8Dg=w@rHN`VKT&LnXBnMiLXjycN}NwW8ejj+l!6}AYcH2}Y4$G?)A^*;#8Gu9%4
z=F&UbjkyF48S?A*7enbb`L%JcY?(d+m>$&ah>R#LuXYgcUE<l!=yPul3qhAq8_T^K
zE@=A2)y8}N1tVgqg<r*%sd$0V4_E7+ugiUo?~s2e*~qUNGj%%K*j*CNi(1vhNW(g#
zd;e~OwZ4;E^gMVjw>e?6vMctErTFg&x*oaTJ3{7ST%;Jf;o{o4E){2);w|I3BgO}V
zFllY3>#zTIwRHTPx=|CE<SaT4bFF*4AV2y%ZOg@avLIqk?RodP195R9OxX|$qP_jp
zrU%{6Ce`@`-hZl8#Z_6P6<Nc!h}X*KnX13q+!f-HB#(n4@Y{LxpxKgoPZI<4;^_7_
za-$Y~UH?$sV-_9xPSko$6NB~Q9lQajWAg7TUKwPA3@ceaH@_9Z-`wi&9-3$iYMsb@
zn%J0X9PM;HHJZKg@5V#ogrPT@`k-HC_o36IwbN=XACFtq-}O9KV#!qbk?Pv8{yT7^
ze#K$9M1)<;sO(X7c2pg5dh)~wclb$o8~35-au8W!iPtG>OC-_z2m=NtLeLzYNhrhq
zLezeB(%43`Z+(!5Pi*Z&sol&!VhFbCMH;<R+smY0c?$N)(E<%8iJ?~Fh)cccGF5Xm
zSHt8Ljx1gyUOX2Y@z@9_dRedAxiZlXeW`In+kPGLQYzq&2wY$15tJdFGTbH!s;}<1
zY>VoHVyG)bgPC&i8C}AAm9-13vn&ps)JhjyerklfVi%)6X0H=quAo=&+ed*zA88R0
zLls@AJGOt>JW^(6EI8jEB|Vy>LQU7#>n<$NAl6BIu!nupRB;BdyGvS`nqEP3tR=Jh
zySxbcsSN<W&P=9aRENyYGxlP;D{A}*uSfn3dTY&!M{@VbjVkVDo_j$Iy=wvzV4rWq
zerZ)|`auL+8d04x_%kY>eZvO9b`?XtZg=EYc)r`Ah=6@67}8B^6N&q*Z;^Z4dcu((
zq~kouG9|S6#-2?!^1kDhY97K%6YUF8rz)Lv&Bp|vtl5IXzHyX62zTB;R65dsD@Hzv
zz?1A1T9od$A5kfbY0JmZTuy$n<>4~`lVi~Cq)-%$5?Aa^i$@kdD=TRanr|ctLDQaS
z;ED6(Gm;G{ys5}z96CXjik+&?ZvFZu`w2)wja|%h7xu}$R4dY`%+kw__D~>ROu6t?
z1l|{{w6Xsjg*IP1qp@;11Wqs~YrS4gqgQP%?LmA@{xz5lpe9|r1ihp1*{MQ~C=jn4
z<b|dC0>dHMeVy*ee{~7O%-|!WofPxjrOP2L$HJ${H93z0DKZ{c;=}hvn&%$3U7k~B
z9fCY@xcC)8qbTJ`1yle&4mtD}PWu95-gPAQQwYy_9)1X5`oq-p(vlZ0F7<q>Qr`Q3
z_4m9l`y%}tu9)%Skr*$+0pQ9B>!rMs@@=m!Mp^fXEa&$;I~9-Y0V=vUdTW~Ik}*9o
z`6-^siL}&;p93s3n`4Dgqy;ndt#eIF&$DD`C;ib^H-ev*=m#XZZVV=nrL-2&?DGuy
z%?K>>?d;?E?w@JYj#=~YGP`Z_f;HK*3H%nSLtffKD;?x@a(JotQgK?U;URo=;`sdZ
zZza6SzK=hPG7YyfmhK`dFOIs~3O`sf;CKD@{y*g*O^ru{*Cjohltk;V(kLT0Wj@+t
zo>Vwj`;8<R;h?1?6ls8zGUyq!N)b1h@RTWT@6@r2va*S2?G<DEldLI@(xv*HT5Z0!
z;h-@FBPQ{c@K^p?)%P*2L```9(TztYsZ#UYrw2!Aw-#6W;Xh?Ay7b66tsWJLRP7+w
ztWEaFH`guU-EM)xv2@_4c8Os$)n~Z?Lh22$Bo?TT6lWUxf|MF=m;u<`mg7^wzl0m`
zsj}V&>y$o=IAs;3l4VhSMhuj5a__9)+SOj4<$V3xMX|nemPK`PVAMQStV#w85ndo#
z)E@ac?M9MgCwRORboKvi4~uS%yjZV&DKM7LL^UX3A>wy;{Rw$B>^WDWUsH&ALr!uW
zUcI@vA#5jas+#4r8nK(%^fTo!=T-=3CtzM~l}RfS)#-#@N^T+CfR_}g2gca`u%v@#
zg6I|~1l{d0WLGF{P>Ua6P0EA9MpE&Y8-*OCDjzLx+{a1#jLdKxuEQh{80lg-Iru>a
z!#ArNKQFOV_`9D1%h0~$8h`cVr|iE(gH3S#3U6B55}Yw8hD7KqP`$ZP0S}FE|DMak
zxM(_GgpJs+5Nw&rN|<G?smbdLhCM1j#5tPa$gQN<R-9*QW8q@xN~72vi!uN3N-BY*
z3rMYNt7u0U?8;4f0H4?F&g7p4G9MdrBzA@jNAA}T1X)Pzs~MS&6GvJ7JELvBcakFu
zLLO5V&``-j<;>s7k&j2RFPP#ShT=J>9M8ERuElVqI>-Fv&e;=Ryw?2BW>J;*j+YV`
zo@s@csG)+RUAKB-E{g$fVg$n;A{qTQo2#-$D^j$-m12YwDP=L7zJ&C-0)0N-l^dPU
zJt+jegoKs#as8$`tV5-4-`c^UYu~>N#4$eglFN1)($I7s{1JKaq-l-?J^3>H099E~
zwS>SJe51vHMkQ4E#!dq(VKbfgwRsd1ywgv!_5NF7&_1!#puptGx1*|oi)};q-YyJ?
zJsai1w=Cq$ilJnyZ;12|Qnx&v9iJ!F-INOvN6C`;zwDUkq1Nwi5sOo+K*iqkZ6fd;
z-(*>gLFc;5u#v&UXCF$W&Z7%FgrIR6bF)i;Il#`_+G`fok1eXfjf3plvA?GnJ*0k0
z*og!SUFp$q6{`E^$2aYmw5-sR{lnm}Sq<g`AoW#RkF?{Kb9+GxcfE4iD!2K<a2wHz
zN)E^ot(9vwtH$TTgrM6>N(mdvyX}*eSggs2BKgrv(fYkpb>3jb2jIY=D~3G)zrtXy
z4vB~SV#h&$7RNNdQ&>4c4rtgBx)_yjNE$Y)7Tm?uF?&SoDZc<4IlEO>i02s%pLgCf
z!U@_;aXA|J#LlEHaeqV5Pz=b8#+l|eH<eB^im%r&I$?v7A7?>693<Sl+w^2zP>QK@
zLi@RI+%*~{Cdw(^<`uA!tqSLRCz-1k!Z|~cnX-%R6NBjj3Dq9(xPEuLfOBU8^y86e
zoxcI`=F-589HTXTnEvE}V%JIrIL<n^`RNeEu!}~Kya4-@Z9!jMmjoTZa{HLwQ8%a8
z0hru=JBCad9d|aj`Q9Gkh5!)jBR3HrF#w~yUHJFv#oTt4@X&J{9pQTYbXRS=e#-JG
z&_lC2ha%S+A1n>ez_E6~zN`A*+Gz9dKLp<U><*ei(&}4GZ+r=2G(0uBDMfEbi;)sS
z-Hs6m#L#hd==*tI_^KM!{lH^ENV3xag%o3&Z$Qd6175yI<1m_UrIF|BxY$X2KjPK%
zU08^zP8|=uSjVk(iw@zWWgG{WX*wdpL;|AOqn{%A0u-3dW>jEDF{Ys;b33OQ%*o@p
zLP03#)62mK$ZC#O6uw|~y(kkl7Hk9pZ-E`4(|mJYHH6bl<Iov`P-!N$3fmRvIzS1_
zIM)ILE;+j6nX<7EH2hR7NS7<*FT3KA;6BPUF%DqF`;}__b^{Syu^ppO@Qf6bT3Gv|
z_B-)3+uK+gvxE7}2xs6~ZxG$!01JF*p}WlpY~w|)UmvbhmK&87!$QtDfpAGPmjrV&
zK35#jM6i&kDH0|}d*r6q6PU58g0KoT@36UH4*_u&;j+#4s8qs7Fw~^-X9<SdBsz_f
zc?tGur)P%}0Pkin$jp*44OhwYYPAxOLa7A7a4Dl@at<W5g);x|my~T$GT;bVaOY>-
zw#d=1jUO;R&g$bjH8p|VroGO%2q#!HG2lnhvf$<n<3Z%1ErDdyx%)#@hluw!hn>pV
z*UiqFjrOp>G@#E}P)#1cIzL&3=*eu{o^jkYO{^^!%udu9`=iq@F)ndj0Q1{?V^sx(
zpyY*@Yi+d4A)Kl~TPo<ZcH|i0w1%s`UvS)VM`=K;-p<Wg26|+g5&dxKmt|Ox;t9%B
z7U&w8R^Jynep8Rh=;lehpZc)=flYq%FI#jZ&mykg;7YUulcc=J`JX>@e1)L!FJCwe
z^iX(~1Xz3&vQ{@W{e3H6-R4W}{4dkoR~fR3N-I%B7Q_5RNogj5m{~RZGSXQTrJV@%
z6s!nX`rT4E)==Y}jtJp^^b~wM*#U)LI1w?Nvpx9dHBf0!@oyase7jja(E9~Oz$qWT
zPo8J6CY$U<;1!y9Lv!KFXA$S$;|1=<YK8eY_5N#=t`X3oW4Qg^VNg2omlrwB-dM(<
ze;wqWw;0N&uLnoyF7L_;bvurQ_`{Jy(<K4xz>)WM_Jes6*Wc5b#H}Qseye#H<<pMc
zG)TvHfp5=^a32&vB+ia)u5AZ92RU5Me=$=)4-}RcGshe2A6BnS>4gNlg`H<o?}I!z
z(#3d}xylTvyf5PhP>znQ;!o9GCBF=S%mAOthn5n&-S6%|%7O{?+XR<W640<2=1qbk
z@DsNk4SQ~Un9wG%CVvb4G!lYlgjOw1Mb?yMY71}ueBlpktlzSyur0`lxBj3c?Ng#r
zuxg%yC%iUqtj$-eM^h&Zvu`#^-rIIM&ot?j9S#7UaIQPx=Ab_^Jc|y_)db&Bdj{;*
z-q60JB+aM@Ts=U|GX_8zvUg}?eNh8HT~MHIgg?<@yxl9cg;+!$E?;rx7Do5=LjF(w
es1OinTpH<fbz6z-uVHQKY;Atttjxsi{(k^Hy2Ske

literal 0
HcmV?d00001

diff --git a/packages/trace-viewer/src/sw/main.ts b/packages/trace-viewer/src/sw/main.ts
index 0e7ff887cc332..b4da5a5cd5af7 100644
--- a/packages/trace-viewer/src/sw/main.ts
+++ b/packages/trace-viewer/src/sw/main.ts
@@ -70,8 +70,8 @@ async function loadTrace(traceUrl: string, traceFileName: string | null, client:
     if (error instanceof TraceVersionError)
       throw new Error(`Could not load trace from ${traceFileName || traceUrl}. ${error.message}`);
     if (traceFileName)
-      throw new Error(`Could not load trace from ${traceFileName}. Make sure to upload a valid Playwright trace.`);
-    throw new Error(`Could not load trace from ${traceUrl}. Make sure a valid Playwright Trace is accessible over this url.`);
+      throw new Error(`Could not load trace from ${traceFileName}. Make sure to upload a valid TestZeus trace.`);
+    throw new Error(`Could not load trace from ${traceUrl}. Make sure a valid TestZeus Trace is accessible over this url.`);
   }
   const snapshotServer = new SnapshotServer(traceModel.storage(), sha1 => traceModel.resourceForSha1(sha1));
   loadedTraces.set(traceUrl, { traceModel, snapshotServer });
diff --git a/packages/trace-viewer/src/ui/networkResourceDetails.tsx b/packages/trace-viewer/src/ui/networkResourceDetails.tsx
index 5c87cb8d75faa..d40f9efe0a663 100644
--- a/packages/trace-viewer/src/ui/networkResourceDetails.tsx
+++ b/packages/trace-viewer/src/ui/networkResourceDetails.tsx
@@ -97,7 +97,7 @@ const CopyDropdown: React.FC<{
       <div className='copy-request-dropdown-menu'>
         <CopyToClipboardTextButton description='Copy as cURL' copiedDescription={copiedDescription} value={() => generateCurlCommand(resource)}/>
         <CopyToClipboardTextButton description='Copy as Fetch' copiedDescription={copiedDescription} value={() => generateFetchCall(resource)}/>
-        <CopyToClipboardTextButton description='Copy as Playwright' copiedDescription={copiedDescription} value={copyAsPlaywright}/>
+        <CopyToClipboardTextButton description='Copy as ' copiedDescription={copiedDescription} value={copyAsPlaywright}/>
       </div>
     </div>
   );
diff --git a/packages/trace-viewer/src/ui/uiModeView.tsx b/packages/trace-viewer/src/ui/uiModeView.tsx
index b5938bd0454f0..b4bf8d6312cbf 100644
--- a/packages/trace-viewer/src/ui/uiModeView.tsx
+++ b/packages/trace-viewer/src/ui/uiModeView.tsx
@@ -440,8 +440,8 @@ export const UIModeView: React.FC<{}> = ({
       </div>}
       sidebar={<div className='vbox ui-mode-sidebar'>
         <Toolbar noShadow={true} noMinHeight={true}>
-          <img src='playwright-logo.svg' alt='Playwright logo' />
-          <div className='section-title'>Playwright</div>
+          <img src='testzeus-logo-light.png' alt='TestZeus logo' />
+          <div className='section-title'>TestZeus Trace Viewer</div>
           <ToolbarButton icon='refresh' title='Reload' onClick={() => reloadTests()} disabled={isRunningTest || isLoading}></ToolbarButton>
           <div style={{ position: 'relative' }}>
             <ToolbarButton icon={'terminal'} title={'Toggle output — ' + (isMac ? '⌃`' : 'Ctrl + `')} toggled={isShowingOutput} onClick={() => { setIsShowingOutput(!isShowingOutput); }} />
diff --git a/packages/trace-viewer/src/ui/workbenchLoader.tsx b/packages/trace-viewer/src/ui/workbenchLoader.tsx
index 519b7fea7823d..b126664a29764 100644
--- a/packages/trace-viewer/src/ui/workbenchLoader.tsx
+++ b/packages/trace-viewer/src/ui/workbenchLoader.tsx
@@ -188,9 +188,9 @@ export const WorkbenchLoader: React.FunctionComponent<{
   return <div className='vbox workbench-loader' onDragOver={event => { event.preventDefault(); setDragOver(true); }}>
     <div className='hbox header' {...(showFileUploadDropArea ? { inert: true } : {})}>
       <div className='logo'>
-        <img src='playwright-logo.svg' alt='Playwright logo' />
+        <img src='testzeus-logo-light.png' alt='TestZeus logo' />
       </div>
-      <div className='product'>Playwright</div>
+      <div className='product'>TestZeus Trace Viewer</div>
       {model.title && <div className='title'>{model.title}</div>}
       <div className='spacer'></div>
       <DialogToolbarButton icon='settings-gear' title='Settings' dialogDataTestId='settings-toolbar-dialog'>
@@ -208,7 +208,7 @@ export const WorkbenchLoader: React.FunctionComponent<{
     </div>}
     <Dialog open={showProgressDialog} isModal={true} className='progress-dialog'>
       <div className='progress-content'>
-        <div className='title' role='heading' aria-level={1}>Loading Playwright Trace...</div>
+        <div className='title' role='heading' aria-level={1}>Loading TestZeus Trace...</div>
         <div className='progress-wrapper'>
           <div className='inner-progress' style={{ width: progress.total ? (100 * progress.done / progress.total) + '%' : 0 }}></div>
         </div>
@@ -216,7 +216,7 @@ export const WorkbenchLoader: React.FunctionComponent<{
     </Dialog>
     {showFileUploadDropArea && <div className='drop-target'>
       <div className='processing-error' role='alert'>{processingErrorMessage}</div>
-      <div className='title' role='heading' aria-level={1}>Drop Playwright Trace to load</div>
+      <div className='title' role='heading' aria-level={1}>Drop TestZeus Trace to load</div>
       <div>or</div>
       <button onClick={() => {
         const input = document.createElement('input');
@@ -225,7 +225,7 @@ export const WorkbenchLoader: React.FunctionComponent<{
         input.click();
         input.addEventListener('change', e => handleFileInputChange(e));
       }} type='button'>Select file(s)</button>
-      <div style={{ maxWidth: 400 }}>Playwright Trace Viewer is a Progressive Web App, it does not send your trace anywhere,
+      <div style={{ maxWidth: 400 }}>TestZeus Trace Viewer is a Progressive Web App, it does not send your trace anywhere,
         it opens it locally.</div>
     </div>}
     {isServer && !traceURLs.length && <div className='drop-target'>
@@ -234,7 +234,7 @@ export const WorkbenchLoader: React.FunctionComponent<{
     {dragOver && <div className='drop-target'
       onDragLeave={() => { setDragOver(false); }}
       onDrop={event => handleDropEvent(event)}>
-      <div className='title'>Release to analyse the Playwright Trace</div>
+      <div className='title'>Release to analyse the TestZeus Trace</div>
     </div>}
   </div>;
 };
diff --git a/packages/trace-viewer/uiMode.html b/packages/trace-viewer/uiMode.html
index 0307c89ac6815..537c9f1983d7c 100644
--- a/packages/trace-viewer/uiMode.html
+++ b/packages/trace-viewer/uiMode.html
@@ -18,8 +18,8 @@
   <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <link rel="icon" href="/playwright-logo.svg" type="image/svg+xml">
-    <title>Playwright Test</title>
+    <link rel="icon" href="/testzeus-logo.png" type="image/svg+xml">
+    <title>TestZeus Test</title>
   </head>
   <body>
     <div id="root"></div>

From 4d52963660fd7056a036b367c35b89b0e173ea76 Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Wed, 11 Mar 2026 19:52:39 +0530
Subject: [PATCH 02/28] Add Helm charts and GitHub Actions deployment workflow
 for trace-viewer

---
 .github/workflows/deploy.yaml | 181 ++++++++++++++++++++++++++++++++++
 helm/Chart.yaml               |  10 ++
 helm/templates/NOTES.txt      |  32 ++++++
 helm/values-dev.yaml          | 103 +++++++++++++++++++
 helm/values-prod.yaml         | 102 +++++++++++++++++++
 helm/values.yaml              |   1 +
 6 files changed, 429 insertions(+)
 create mode 100644 .github/workflows/deploy.yaml
 create mode 100644 helm/Chart.yaml
 create mode 100644 helm/templates/NOTES.txt
 create mode 100644 helm/values-dev.yaml
 create mode 100644 helm/values-prod.yaml
 create mode 100644 helm/values.yaml

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
new file mode 100644
index 0000000000000..175bd08d2fe8c
--- /dev/null
+++ b/.github/workflows/deploy.yaml
@@ -0,0 +1,181 @@
+name: Build and Deploy
+
+on:
+  push:
+    branches:
+      - dev
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  SERVICE_NAME: traceviewer
+  APP_DIR: .
+  DOCKERFILE: packages/trace-viewer/Dockerfile
+  CHART_DIR: helm
+  GAR_LOCATION: ${{ vars.GAR_LOCATION }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+      image_repo: ${{ steps.meta.outputs.image_repo }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Authenticate to Google Cloud
+        id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ github.ref == 'refs/heads/main' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ github.ref == 'refs/heads/main' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+          token_format: access_token
+
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+
+      - name: Login to GAR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.auth.outputs.access_token }}
+
+      - name: Build image metadata
+        id: meta
+        run: |
+          IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}"
+          PROJECT_ID="${{ github.ref == 'refs/heads/main' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
+          GAR_REPO="${{ github.ref == 'refs/heads/main' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
+          HELM_REPO="${{ vars.GAR_HELM_REPOSITORY_PROD }}"
+          IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"
+          echo "image_tag=${IMAGE_TAG}" >>"${GITHUB_OUTPUT}"
+          echo "image_repo=${IMAGE_REPO}" >>"${GITHUB_OUTPUT}"
+          echo "helm_repo=${HELM_REPO}" >>"${GITHUB_OUTPUT}"
+          echo "project_id=${PROJECT_ID}" >>"${GITHUB_OUTPUT}"
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.APP_DIR }}
+          file: ${{ env.DOCKERFILE }}
+          push: true
+          tags: ${{ steps.meta.outputs.image_repo }}:${{ steps.meta.outputs.image_tag }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy-dev:
+    if: github.ref == 'refs/heads/dev'
+    needs: build
+    runs-on: ubuntu-latest
+    environment: dev
+    env:
+      GKE_CLUSTER: ${{ vars.GKE_DEV_CLUSTER }}
+      GKE_LOCATION: ${{ vars.GKE_DEV_LOCATION }}
+      GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_DEV }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v4.0.0
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ secrets.GCP_SA_DEV }}
+
+      - name: Get GKE credentials
+        uses: google-github-actions/get-gke-credentials@v2
+        with:
+          cluster_name: ${{ env.GKE_CLUSTER }}
+          location: ${{ env.GKE_LOCATION }}
+          project_id: ${{ env.GCP_PROJECT_ID }}
+
+      - name: Login Helm to GAR OCI registry
+        run: |
+          gcloud auth print-access-token | \
+            helm registry login -u oauth2accesstoken --password-stdin \
+            "${GAR_LOCATION}-docker.pkg.dev"
+
+      - name: Helm dependency update
+        run: helm dependency update "${CHART_DIR}"
+
+      - name: Helm deploy to dev
+        run: |
+          helm upgrade "${SERVICE_NAME}" "${CHART_DIR}" \
+            -f "${CHART_DIR}/values-dev.yaml" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ secrets.GCP_SA_DEV }} \
+            --namespace "testzeus-dev" \
+            --create-namespace \
+            --install \
+            --rollback-on-failure \
+            --timeout 5m
+
+  deploy-prod:
+    if: github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    environment: production
+    env:
+      GKE_CLUSTER: ${{ vars.GKE_PROD_CLUSTER }}
+      GKE_LOCATION: ${{ vars.GKE_PROD_LOCATION }}
+      GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_PROD }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v4.0.0
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER_PROD }}
+          service_account: ${{ secrets.GCP_SA_PROD }}
+
+      - name: Get GKE credentials
+        uses: google-github-actions/get-gke-credentials@v2
+        with:
+          cluster_name: ${{ env.GKE_CLUSTER }}
+          location: ${{ env.GKE_LOCATION }}
+          project_id: ${{ env.GCP_PROJECT_ID }}
+
+      - name: Login Helm to GAR OCI registry
+        run: |
+          gcloud auth print-access-token | \
+            helm registry login -u oauth2accesstoken --password-stdin \
+            "${GAR_LOCATION}-docker.pkg.dev"
+
+      - name: Helm dependency update
+        run: helm dependency update "${CHART_DIR}"
+
+      - name: Helm deploy to prod
+        run: |
+          helm upgrade "${SERVICE_NAME}" "${CHART_DIR}" \
+            -f "${CHART_DIR}/values-prod.yaml" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ secrets.GCP_SA_PROD }} \
+            --namespace "testzeus-prod" \
+            --create-namespace \
+            --install \
+            --rollback-on-failure \
+            --timeout 5m
\ No newline at end of file
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
new file mode 100644
index 0000000000000..a5428743e3a5d
--- /dev/null
+++ b/helm/Chart.yaml
@@ -0,0 +1,10 @@
+apiVersion: v2
+name: trace-viewer
+version: 1.0.0
+description: Playwright trace viewer
+type: application
+
+dependencies:
+  - name: service-template
+    version: "~0.6.0"
+    repository: "oci://us-central1-docker.pkg.dev/prod-testarmy/helm-repository-prod"
\ No newline at end of file
diff --git a/helm/templates/NOTES.txt b/helm/templates/NOTES.txt
new file mode 100644
index 0000000000000..a575851895c4f
--- /dev/null
+++ b/helm/templates/NOTES.txt
@@ -0,0 +1,32 @@
+{{- $values := index .Values "service-template" -}}
+1. Get the application URL by running these commands:
+{{- if $values.service }}
+  {{- if contains "LoadBalancer" ($values.service.type | default "ClusterIP") }}
+    NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+          You can watch the status by running 'kubectl get svc -w {{ .Release.Name }}-service-template'
+    export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ .Release.Name }}-service-template --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+    echo http://$SERVICE_IP:{{ $values.service.port | default 80 }}
+  {{- else if contains "ClusterIP" ($values.service.type | default "ClusterIP") }}
+    {{- $appName := $values.fullnameOverride | default "service-template" -}}
+    export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ $appName }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+    echo "Visit http://127.0.0.1:8080 to use your application"
+    {{- $containerPort := 8080 -}}
+    {{- if $values.containers -}}
+      {{- if (index $values.containers 0).ports -}}
+        {{- $containerPort = (index (index $values.containers 0).ports 0).containerPort | default 8080 -}}
+      {{- end -}}
+    {{- end -}}
+    kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ $containerPort }}
+  {{- else if contains "NodePort" ($values.service.type | default "ClusterIP") }}
+    export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ .Release.Name }}-service-template)
+    export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+    echo http://$NODE_IP:$NODE_PORT
+  {{- end }}
+{{- end }}
+
+{{- if and $values.autoscaling (and $values.autoscaling.enabled (and $values.vpa $values.vpa.enabled)) }}
+WARNING: Both HPA and VPA are enabled. This is a conflicting configuration as both will try to manage resources for the same workload.
+{{- end }}
+{{- if and $values.persistentStorage (and $values.persistentStorage.enabled (eq $values.persistentStorage.accessMode "ReadWriteOnce") (gt (int ($values.replicaCount | default 1)) 1)) }}
+WARNING: persistentStorage is enabled with ReadWriteOnce access mode but replicaCount is greater than 1. Only one pod will be able to mount the volume.
+{{- end }}
\ No newline at end of file
diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
new file mode 100644
index 0000000000000..46a17ff3a78c7
--- /dev/null
+++ b/helm/values-dev.yaml
@@ -0,0 +1,103 @@
+service-template:
+  fullnameOverride: "testzeus-traceviewer"
+  replicaCount: 1
+
+  serviceAccount:
+    create: true
+    name: "testzeus-traceviewer-sa"
+    automount: false  # nginx does not call the K8s API
+
+  podSecurityContext:
+    seccompProfile:
+      type: RuntimeDefault
+
+  containers:
+    - name: trace-viewer
+      image:
+        repository:   
+        tag: REPLACED_BY_CI
+        pullPolicy: Always
+      ports:
+        - containerPort: 80
+      env:
+        - name: HOST
+          value: "0.0.0.0"
+        - name: PORT
+          value: "80"
+        - name: NODE_ENV
+          value: development
+      resources:
+        requests:
+          cpu: "25m"
+          memory: "32Mi"
+        limits:
+          cpu: "100m"
+          memory: "128Mi"
+      readinessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        failureThreshold: 3
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 10
+        periodSeconds: 20
+        failureThreshold: 3
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        runAsUser: 101  # nginx user
+        runAsGroup: 101
+        capabilities:
+          drop:
+            - ALL
+
+  service:
+    enabled: true
+    type: ClusterIP
+    port: 80
+    targetPort: 80
+
+  autoscaling:
+    enabled: true
+    minReplicas: 2
+    maxReplicas: 5
+    targetCPUUtilizationPercentage: 80
+
+  pdb:
+    enabled: true
+    minAvailable: 1
+
+  httpRoute:
+    enabled: true
+    parentRefs:
+      - name: main-gateway
+        namespace: gateway-infra
+        sectionName: http
+    hostnames:
+      - "tzviewer.dev.testzeus.app"
+    rules:
+      - matches:
+          - path:
+              value: /
+              type: PathPrefix
+
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - weight: 100
+          podAffinityTerm:
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: testzeus-traceviewer
+            topologyKey: kubernetes.io/hostname
+
+  tolerations:
+    - key: "cloud.google.com/gke-spot"
+      operator: "Equal"
+      value: "true"
+      effect: "NoSchedule"
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
new file mode 100644
index 0000000000000..1a591f6ca555a
--- /dev/null
+++ b/helm/values-prod.yaml
@@ -0,0 +1,102 @@
+service-template:
+  fullnameOverride: "testzeus-traceviewer"
+  replicaCount: 2
+
+  serviceAccount:
+    create: true
+    name: "testzeus-traceviewer-sa"
+    automount: false  # nginx does not call the K8s API
+
+  podSecurityContext:
+    seccompProfile:
+      type: RuntimeDefault
+
+  containers:
+    - name: trace-viewer
+      image:
+        repository: REPLACED_BY_CI
+        tag: REPLACED_BY_CI
+        pullPolicy: Always
+      ports:
+        - containerPort: 80
+      env:
+        - name: HOST
+          value: "0.0.0.0"
+        - name: PORT
+          value: "80"
+        - name: NODE_ENV
+          value: production
+      resources:
+        requests:
+          cpu: "50m"
+          memory: "64Mi"
+        limits:
+          cpu: "200m"
+          memory: "256Mi"
+      readinessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        failureThreshold: 3
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 10
+        periodSeconds: 20
+        failureThreshold: 3
+      securityContext:
+        allowPrivilegeEscalation: false
+        runAsNonRoot: true
+        runAsUser: 101  # nginx user
+        runAsGroup: 101
+        capabilities:
+          drop:
+            - ALL
+
+  service:
+    enabled: true
+    type: ClusterIP
+    port: 80
+    targetPort: 80
+
+  autoscaling:
+    enabled: true
+    minReplicas: 2
+    maxReplicas: 10
+    targetCPUUtilizationPercentage: 70
+
+  pdb:
+    enabled: true
+    minAvailable: 2
+
+  httpRoute:
+    enabled: true
+    parentRefs:
+      - name: main-gateway
+        namespace: gateway-infra
+        sectionName: http
+    hostnames:
+      - "tzviewer.testzeus.app"
+    rules:
+      - matches:
+          - path:
+              value: /
+              type: PathPrefix
+
+  affinity:
+    podAntiAffinity:
+      # Hard rule in prod: pods MUST be on different nodes
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: testzeus-traceviewer
+          topologyKey: kubernetes.io/hostname
+
+  tolerations:
+    - key: "cloud.google.com/gke-spot"
+      operator: "Equal"
+      value: "true"
+      effect: "NoSchedule"
diff --git a/helm/values.yaml b/helm/values.yaml
new file mode 100644
index 0000000000000..5cd3298b03d7f
--- /dev/null
+++ b/helm/values.yaml
@@ -0,0 +1 @@
+﻿service-template: { enabled: true }
\ No newline at end of file

From f227873ad4ebfd38182df39ac6096b0acc3bbb2c Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Wed, 11 Mar 2026 20:39:32 +0530
Subject: [PATCH 03/28] Downgrade service-template to ~0.5.0

---
 helm/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/helm/Chart.yaml b/helm/Chart.yaml
index a5428743e3a5d..f7e383dba5158 100644
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -6,5 +6,5 @@ type: application
 
 dependencies:
   - name: service-template
-    version: "~0.6.0"
+    version: "~0.5.0"
     repository: "oci://us-central1-docker.pkg.dev/prod-testarmy/helm-repository-prod"
\ No newline at end of file

From d1cc6ce7008b453871ebdfa1457c85483b9b8e52 Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Wed, 11 Mar 2026 22:23:14 +0530
Subject: [PATCH 04/28] Remove spot tolerations

---
 helm/values-dev.yaml  | 5 -----
 helm/values-prod.yaml | 5 -----
 2 files changed, 10 deletions(-)

diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index 46a17ff3a78c7..2ded37be523e2 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -96,8 +96,3 @@ service-template:
                 app.kubernetes.io/name: testzeus-traceviewer
             topologyKey: kubernetes.io/hostname
 
-  tolerations:
-    - key: "cloud.google.com/gke-spot"
-      operator: "Equal"
-      value: "true"
-      effect: "NoSchedule"
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index 1a591f6ca555a..27cef35651505 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -95,8 +95,3 @@ service-template:
               app.kubernetes.io/name: testzeus-traceviewer
           topologyKey: kubernetes.io/hostname
 
-  tolerations:
-    - key: "cloud.google.com/gke-spot"
-      operator: "Equal"
-      value: "true"
-      effect: "NoSchedule"

From 73a99ea77b623c95f3006a4c7905584302409302 Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Wed, 11 Mar 2026 23:39:01 +0530
Subject: [PATCH 05/28] Scrub secrets from values files

---
 helm/values-dev.yaml  | 9 ---------
 helm/values-prod.yaml | 8 --------
 2 files changed, 17 deletions(-)

diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index 2ded37be523e2..90d7d38da0fb5 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -86,13 +86,4 @@ service-template:
               value: /
               type: PathPrefix
 
-  affinity:
-    podAntiAffinity:
-      preferredDuringSchedulingIgnoredDuringExecution:
-        - weight: 100
-          podAffinityTerm:
-            labelSelector:
-              matchLabels:
-                app.kubernetes.io/name: testzeus-traceviewer
-            topologyKey: kubernetes.io/hostname
 
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index 27cef35651505..a97220c26bb34 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -86,12 +86,4 @@ service-template:
               value: /
               type: PathPrefix
 
-  affinity:
-    podAntiAffinity:
-      # Hard rule in prod: pods MUST be on different nodes
-      requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: testzeus-traceviewer
-          topologyKey: kubernetes.io/hostname
 

From 9ae3dd85d6b8d488e80d3c0bc99346b8c2bd24ba Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Thu, 12 Mar 2026 12:18:23 +0530
Subject: [PATCH 06/28] Refactor to ExternalSecrets and HttpRoute structure

---
 helm/values-dev.yaml  | 7 ++++---
 helm/values-prod.yaml | 7 ++++---
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index 90d7d38da0fb5..e4f5b84e37afc 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -14,8 +14,8 @@ service-template:
   containers:
     - name: trace-viewer
       image:
-        repository:   
-        tag: REPLACED_BY_CI
+        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_DEV/GAR_DOCKER_REPOSITORY_DEV"
+        tag: latest
         pullPolicy: Always
       ports:
         - containerPort: 80
@@ -86,4 +86,5 @@ service-template:
               value: /
               type: PathPrefix
 
-
+  secrets:
+    enabled: false # No secrets for trace-viewer yet
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index a97220c26bb34..e8059cb833c98 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -14,8 +14,8 @@ service-template:
   containers:
     - name: trace-viewer
       image:
-        repository: REPLACED_BY_CI
-        tag: REPLACED_BY_CI
+        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_PROD/GAR_DOCKER_REPOSITORY_PROD"
+        tag: latest
         pullPolicy: Always
       ports:
         - containerPort: 80
@@ -86,4 +86,5 @@ service-template:
               value: /
               type: PathPrefix
 
-
+  secrets:
+    enabled: false # No secrets for trace-viewer yet

From d82e7967fac1246099eb003f6de7b520560e6481 Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Thu, 12 Mar 2026 18:20:25 +0530
Subject: [PATCH 07/28] Add Dockerfile and Nginx configuration for trace-viewer

---
 packages/trace-viewer/Dockerfile | 25 +++++++++++++++++++++++
 packages/trace-viewer/nginx.conf | 35 ++++++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 packages/trace-viewer/Dockerfile
 create mode 100644 packages/trace-viewer/nginx.conf

diff --git a/packages/trace-viewer/Dockerfile b/packages/trace-viewer/Dockerfile
new file mode 100644
index 0000000000000..f4731a7a20f11
--- /dev/null
+++ b/packages/trace-viewer/Dockerfile
@@ -0,0 +1,25 @@
+FROM node:20-alpine AS build
+WORKDIR /app
+
+# Copy entire monorepo to satisfy Vite aliases used by trace-viewer
+COPY . .
+
+# Install repo dependencies
+RUN npm ci
+
+# Build trace-viewer (service worker first, then app)
+WORKDIR /app/packages/trace-viewer
+RUN npx vite build -c ./vite.sw.config.ts
+RUN npx vite build -c ./vite.config.ts
+
+# Runtime image serving static assets with nginx
+FROM nginx:alpine
+
+# Copy build output to nginx web root
+COPY --from=build /app/packages/playwright-core/lib/vite/traceViewer /usr/share/nginx/html
+
+# Use hardened nginx config (path is relative to the build context root)
+COPY packages/trace-viewer/nginx.conf /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/packages/trace-viewer/nginx.conf b/packages/trace-viewer/nginx.conf
new file mode 100644
index 0000000000000..3d88cf6f78d81
--- /dev/null
+++ b/packages/trace-viewer/nginx.conf
@@ -0,0 +1,35 @@
+server {
+    listen 80;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Quiet favicon requests instead of 404 noise
+    location = /favicon.ico {
+        access_log off;
+        log_not_found off;
+        return 204;
+    }
+
+    # Block access to dotfiles
+    location ~ /\.(?!well-known)(.*)$ {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Quiet common scanner/dev-only paths
+    location ~* ^/(?:@vite|actutor|actuator|\.env|\.git|\.vscode) {
+        return 404;
+        access_log off;
+        log_not_found off;
+    }
+
+    # Static files and SPA fallback for known entry points
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+
+

From eb0bddf26b8fd311c636b15f529f681077944c84 Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Thu, 12 Mar 2026 18:20:40 +0530
Subject: [PATCH 08/28] Refine Helm chart templates and values for playwright
 deployment

---
 helm/templates/NOTES.txt | 9 +++++----
 helm/values.yaml         | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/helm/templates/NOTES.txt b/helm/templates/NOTES.txt
index a575851895c4f..fad5246f295b7 100644
--- a/helm/templates/NOTES.txt
+++ b/helm/templates/NOTES.txt
@@ -1,10 +1,11 @@
 {{- $values := index .Values "service-template" -}}
+{{- $serviceName := $values.fullnameOverride | default (printf "%s-service-template" .Release.Name) -}}
 1. Get the application URL by running these commands:
 {{- if $values.service }}
   {{- if contains "LoadBalancer" ($values.service.type | default "ClusterIP") }}
     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-          You can watch the status by running 'kubectl get svc -w {{ .Release.Name }}-service-template'
-    export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ .Release.Name }}-service-template --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+          You can watch the status by running 'kubectl get svc -w {{ $serviceName }}'
+    export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ $serviceName }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
     echo http://$SERVICE_IP:{{ $values.service.port | default 80 }}
   {{- else if contains "ClusterIP" ($values.service.type | default "ClusterIP") }}
     {{- $appName := $values.fullnameOverride | default "service-template" -}}
@@ -18,7 +19,7 @@
     {{- end -}}
     kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ $containerPort }}
   {{- else if contains "NodePort" ($values.service.type | default "ClusterIP") }}
-    export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ .Release.Name }}-service-template)
+    export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ $serviceName }})
     export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
     echo http://$NODE_IP:$NODE_PORT
   {{- end }}
@@ -29,4 +30,4 @@ WARNING: Both HPA and VPA are enabled. This is a conflicting configuration as bo
 {{- end }}
 {{- if and $values.persistentStorage (and $values.persistentStorage.enabled (eq $values.persistentStorage.accessMode "ReadWriteOnce") (gt (int ($values.replicaCount | default 1)) 1)) }}
 WARNING: persistentStorage is enabled with ReadWriteOnce access mode but replicaCount is greater than 1. Only one pod will be able to mount the volume.
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/helm/values.yaml b/helm/values.yaml
index 5cd3298b03d7f..f3bf036c0a0c0 100644
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -1 +1 @@
-﻿service-template: { enabled: true }
\ No newline at end of file
+service-template: { enabled: true }

From 4b3b3eca72366f812b1b872d76b959fe54eb4dbc Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Thu, 12 Mar 2026 18:21:08 +0530
Subject: [PATCH 09/28] Update GitHub deployment workflow with Helm repository
 selection

---
 .github/workflows/deploy.yaml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 175bd08d2fe8c..6dd041cc84272 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -5,6 +5,18 @@ on:
     branches:
       - dev
       - main
+    paths:
+      - .github/workflows/deploy.yaml
+      - helm/**
+      - package.json
+      - package-lock.json
+      - packages/injected/**
+      - packages/playwright-core/**
+      - packages/protocol/**
+      - packages/trace/**
+      - packages/trace-viewer/**
+      - packages/web/**
+      - utils/build/**
   workflow_dispatch:
 
 permissions:
@@ -85,6 +97,7 @@ jobs:
       GKE_CLUSTER: ${{ vars.GKE_DEV_CLUSTER }}
       GKE_LOCATION: ${{ vars.GKE_DEV_LOCATION }}
       GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_DEV }}
+      HELM_REPO: ${{ vars.GAR_HELM_REPOSITORY_DEV }}
     steps:
       - uses: actions/checkout@v4
 
@@ -112,6 +125,10 @@ jobs:
             helm registry login -u oauth2accesstoken --password-stdin \
             "${GAR_LOCATION}-docker.pkg.dev"
 
+      - name: Select Helm repository for dev
+        run: |
+          sed -i "s|repository: \".*\"|repository: \"oci://${GAR_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${HELM_REPO}\"|" "${CHART_DIR}/Chart.yaml"
+
       - name: Helm dependency update
         run: helm dependency update "${CHART_DIR}"
 
@@ -137,6 +154,7 @@ jobs:
       GKE_CLUSTER: ${{ vars.GKE_PROD_CLUSTER }}
       GKE_LOCATION: ${{ vars.GKE_PROD_LOCATION }}
       GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_PROD }}
+      HELM_REPO: ${{ vars.GAR_HELM_REPOSITORY_PROD }}
     steps:
       - uses: actions/checkout@v4
 
@@ -164,6 +182,10 @@ jobs:
             helm registry login -u oauth2accesstoken --password-stdin \
             "${GAR_LOCATION}-docker.pkg.dev"
 
+      - name: Select Helm repository for prod
+        run: |
+          sed -i "s|repository: \".*\"|repository: \"oci://${GAR_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${HELM_REPO}\"|" "${CHART_DIR}/Chart.yaml"
+
       - name: Helm dependency update
         run: helm dependency update "${CHART_DIR}"
 
@@ -178,4 +200,4 @@ jobs:
             --create-namespace \
             --install \
             --rollback-on-failure \
-            --timeout 5m
\ No newline at end of file
+            --timeout 5m

From d5c549d546644b79c2fca8e0f07e74dd7567e626 Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Fri, 13 Mar 2026 13:27:17 +0530
Subject: [PATCH 10/28] Standardize Helm values: set replicaCount to 1 and
 remove autoscaling/PDB

---
 helm/values-dev.yaml  | 10 ----------
 helm/values-prod.yaml | 11 +----------
 2 files changed, 1 insertion(+), 20 deletions(-)

diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index e4f5b84e37afc..fbfd48c7416b8 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -62,16 +62,6 @@ service-template:
     port: 80
     targetPort: 80
 
-  autoscaling:
-    enabled: true
-    minReplicas: 2
-    maxReplicas: 5
-    targetCPUUtilizationPercentage: 80
-
-  pdb:
-    enabled: true
-    minAvailable: 1
-
   httpRoute:
     enabled: true
     parentRefs:
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index e8059cb833c98..67b15f5df65d0 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -1,6 +1,6 @@
 service-template:
   fullnameOverride: "testzeus-traceviewer"
-  replicaCount: 2
+  replicaCount: 1
 
   serviceAccount:
     create: true
@@ -62,15 +62,6 @@ service-template:
     port: 80
     targetPort: 80
 
-  autoscaling:
-    enabled: true
-    minReplicas: 2
-    maxReplicas: 10
-    targetCPUUtilizationPercentage: 70
-
-  pdb:
-    enabled: true
-    minAvailable: 2
 
   httpRoute:
     enabled: true

From 9215dc203f23819084b2a78f293d49c6729ffe6f Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Fri, 13 Mar 2026 14:11:28 +0530
Subject: [PATCH 11/28] Cleanup dead outputs in deployment workflow

---
 .github/workflows/deploy.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 6dd041cc84272..349cc3c0cb792 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -75,8 +75,6 @@ jobs:
           IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"
           echo "image_tag=${IMAGE_TAG}" >>"${GITHUB_OUTPUT}"
           echo "image_repo=${IMAGE_REPO}" >>"${GITHUB_OUTPUT}"
-          echo "helm_repo=${HELM_REPO}" >>"${GITHUB_OUTPUT}"
-          echo "project_id=${PROJECT_ID}" >>"${GITHUB_OUTPUT}"
 
       - name: Build and push image
         uses: docker/build-push-action@v6

From 7f61c9e5a0a51560373f993c7acd6adec27b706e Mon Sep 17 00:00:00 2001
From: secops-zeus <secops@testzeus.com>
Date: Fri, 13 Mar 2026 15:41:38 +0530
Subject: [PATCH 12/28] Update gateway name and namespace in dev values

---
 helm/values-dev.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index fbfd48c7416b8..5e82f7f51caef 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -65,8 +65,8 @@ service-template:
   httpRoute:
     enabled: true
     parentRefs:
-      - name: main-gateway
-        namespace: gateway-infra
+      - name: testzeus-gateway
+        namespace: testzeus
         sectionName: http
     hostnames:
       - "tzviewer.dev.testzeus.app"

From 19b920a1eb1da6b0bb63000f15dad792d5ba4fa7 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Tue, 17 Mar 2026 18:43:45 +0530
Subject: [PATCH 13/28] feat(helm/deploy): fix HTTPRoute, align
 hostnames/resources, add helm4-compat, update upgrade flags

---
 .github/workflows/deploy.yaml | 128 +++++++++++++++++++++++++++++-----
 helm/values-dev.yaml          |  10 +--
 helm/values-prod.yaml         |  12 ++--
 3 files changed, 122 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 349cc3c0cb792..4bbefcc7d0384 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -3,8 +3,7 @@ name: Build and Deploy
 on:
   push:
     branches:
-      - dev
-      - main
+      - main-prod
     paths:
       - .github/workflows/deploy.yaml
       - helm/**
@@ -18,6 +17,12 @@ on:
       - packages/web/**
       - utils/build/**
   workflow_dispatch:
+    inputs:
+      deploy_prod:
+        description: "Deploy to production"
+        required: true
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -46,8 +51,8 @@ jobs:
         id: auth
         uses: google-github-actions/auth@v2
         with:
-          workload_identity_provider: ${{ github.ref == 'refs/heads/main' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
-          service_account: ${{ github.ref == 'refs/heads/main' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+          workload_identity_provider: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
           token_format: access_token
 
       - name: Setup gcloud
@@ -69,9 +74,8 @@ jobs:
         id: meta
         run: |
           IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}"
-          PROJECT_ID="${{ github.ref == 'refs/heads/main' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
-          GAR_REPO="${{ github.ref == 'refs/heads/main' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
-          HELM_REPO="${{ vars.GAR_HELM_REPOSITORY_PROD }}"
+          PROJECT_ID="${{ github.ref == 'refs/heads/main-prod' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
+          GAR_REPO="${{ github.ref == 'refs/heads/main-prod' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
           IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"
           echo "image_tag=${IMAGE_TAG}" >>"${GITHUB_OUTPUT}"
           echo "image_repo=${IMAGE_REPO}" >>"${GITHUB_OUTPUT}"
@@ -86,16 +90,101 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  deploy-dev:
-    if: github.ref == 'refs/heads/dev'
+  helm4-compat:
+    if: github.ref == 'refs/heads/main-prod'
     needs: build
     runs-on: ubuntu-latest
+    env:
+      TARGET_ENV: ${{ github.ref == 'refs/heads/main-prod' && 'prod' || 'dev' }}
+      VALUES_FILE: ${{ github.ref == 'refs/heads/main-prod' && 'values-prod.yaml' || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.ref == 'refs/heads/main-prod' && 'testzeus-prod' || 'testzeus-dev' }}
+      GKE_CLUSTER: ${{ github.ref == 'refs/heads/main-prod' && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
+      GKE_LOCATION: ${{ github.ref == 'refs/heads/main-prod' && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
+      GCP_PROJECT_ID: ${{ github.ref == 'refs/heads/main-prod' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
+      GAR_HELM_REPOSITORY: ${{ github.ref == 'refs/heads/main-prod' && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
+      GCP_SA: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+      GCP_WIF_PROVIDER: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Helm 4 (compat check)
+        uses: azure/setup-helm@v4
+        with:
+          version: v4.0.0
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ env.GCP_WIF_PROVIDER }}
+          service_account: ${{ env.GCP_SA }}
+
+      - name: Get GKE credentials
+        uses: google-github-actions/get-gke-credentials@v2
+        with:
+          cluster_name: ${{ env.GKE_CLUSTER }}
+          location: ${{ env.GKE_LOCATION }}
+          project_id: ${{ env.GCP_PROJECT_ID }}
+
+      - name: Login Helm to GAR OCI registry
+        run: |
+          gcloud auth print-access-token | \
+            helm registry login -u oauth2accesstoken --password-stdin \
+            "${GAR_LOCATION}-docker.pkg.dev"
+
+      - name: Set Helm dependency repository (target env)
+        run: |
+          CHART_REPO="oci://${GAR_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_HELM_REPOSITORY}"
+          sed -i "/- name: service-template/,/repository:/ s#repository: \".*\"#repository: \"${CHART_REPO}\"#" "${CHART_DIR}/Chart.yaml"
+
+      - name: Helm dependency update (Helm 4)
+        run: helm dependency update "${CHART_DIR}"
+
+      - name: Helm lint (Helm 4)
+        run: helm lint "${CHART_DIR}" -f "${CHART_DIR}/${VALUES_FILE}"
+
+      - name: Helm template render (Helm 4)
+        run: |
+          helm template "${SERVICE_NAME}-helm4-compat" "${CHART_DIR}" \
+            -f "${CHART_DIR}/${VALUES_FILE}" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ env.GCP_SA }} \
+            > rendered-helm4.yaml
+
+      - name: Guard rendered manifest fields
+        run: |
+          if grep -nE '^[[:space:]]*(managedFields:|resourceVersion:|uid:|creationTimestamp:)$' rendered-helm4.yaml; then
+            echo "Forbidden metadata fields found in rendered output."
+            exit 1
+          fi
+          if grep -nE '^[[:space:]]*status:[[:space:]]*$' rendered-helm4.yaml; then
+            echo "Forbidden status field found in rendered output."
+            exit 1
+          fi
+
+      - name: Helm upgrade dry-run (Helm 4)
+        run: |
+          helm upgrade "${SERVICE_NAME}-helm4-compat" "${CHART_DIR}" \
+            -f "${CHART_DIR}/${VALUES_FILE}" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ env.GCP_SA }} \
+            --namespace "${DEPLOY_NAMESPACE}" \
+            --create-namespace \
+            --install \
+            --dry-run \
+            --server-side=false \
+            --debug
+
+  deploy-dev:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main-prod'
+    needs: [build, helm4-compat]
+    runs-on: ubuntu-latest
     environment: dev
     env:
       GKE_CLUSTER: ${{ vars.GKE_DEV_CLUSTER }}
       GKE_LOCATION: ${{ vars.GKE_DEV_LOCATION }}
       GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_DEV }}
-      HELM_REPO: ${{ vars.GAR_HELM_REPOSITORY_DEV }}
     steps:
       - uses: actions/checkout@v4
 
@@ -123,9 +212,10 @@ jobs:
             helm registry login -u oauth2accesstoken --password-stdin \
             "${GAR_LOCATION}-docker.pkg.dev"
 
-      - name: Select Helm repository for dev
+      - name: Set Helm dependency repository (dev)
         run: |
-          sed -i "s|repository: \".*\"|repository: \"oci://${GAR_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${HELM_REPO}\"|" "${CHART_DIR}/Chart.yaml"
+          CHART_REPO="oci://${GAR_LOCATION}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID_DEV }}/${{ vars.GAR_HELM_REPOSITORY_DEV }}"
+          sed -i "/- name: service-template/,/repository:/ s#repository: \".*\"#repository: \"${CHART_REPO}\"#" "${CHART_DIR}/Chart.yaml"
 
       - name: Helm dependency update
         run: helm dependency update "${CHART_DIR}"
@@ -140,19 +230,20 @@ jobs:
             --namespace "testzeus-dev" \
             --create-namespace \
             --install \
+            --wait \
             --rollback-on-failure \
+            --server-side=false \
             --timeout 5m
 
   deploy-prod:
-    if: github.ref == 'refs/heads/main'
-    needs: build
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main-prod' && github.event.inputs.deploy_prod == 'true'
+    needs: [build, helm4-compat]
     runs-on: ubuntu-latest
     environment: production
     env:
       GKE_CLUSTER: ${{ vars.GKE_PROD_CLUSTER }}
       GKE_LOCATION: ${{ vars.GKE_PROD_LOCATION }}
       GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_PROD }}
-      HELM_REPO: ${{ vars.GAR_HELM_REPOSITORY_PROD }}
     steps:
       - uses: actions/checkout@v4
 
@@ -180,9 +271,10 @@ jobs:
             helm registry login -u oauth2accesstoken --password-stdin \
             "${GAR_LOCATION}-docker.pkg.dev"
 
-      - name: Select Helm repository for prod
+      - name: Set Helm dependency repository (prod)
         run: |
-          sed -i "s|repository: \".*\"|repository: \"oci://${GAR_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${HELM_REPO}\"|" "${CHART_DIR}/Chart.yaml"
+          CHART_REPO="oci://${GAR_LOCATION}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID_PROD }}/${{ vars.GAR_HELM_REPOSITORY_PROD }}"
+          sed -i "/- name: service-template/,/repository:/ s#repository: \".*\"#repository: \"${CHART_REPO}\"#" "${CHART_DIR}/Chart.yaml"
 
       - name: Helm dependency update
         run: helm dependency update "${CHART_DIR}"
@@ -197,5 +289,7 @@ jobs:
             --namespace "testzeus-prod" \
             --create-namespace \
             --install \
+            --wait \
             --rollback-on-failure \
+            --server-side=false \
             --timeout 5m
diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index 5e82f7f51caef..86474febfbca6 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -28,11 +28,11 @@ service-template:
           value: development
       resources:
         requests:
-          cpu: "25m"
-          memory: "32Mi"
+          cpu: "250m"
+          memory: "512Mi"
         limits:
-          cpu: "100m"
-          memory: "128Mi"
+          cpu: "500m"
+          memory: "512Mi"
       readinessProbe:
         httpGet:
           path: /
@@ -67,7 +67,7 @@ service-template:
     parentRefs:
       - name: testzeus-gateway
         namespace: testzeus
-        sectionName: http
+        sectionName: https
     hostnames:
       - "tzviewer.dev.testzeus.app"
     rules:
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index 67b15f5df65d0..deb3789be89b5 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -28,11 +28,11 @@ service-template:
           value: production
       resources:
         requests:
-          cpu: "50m"
-          memory: "64Mi"
+          cpu: "250m"
+          memory: "512Mi"
         limits:
-          cpu: "200m"
-          memory: "256Mi"
+          cpu: "500m"
+          memory: "512Mi"
       readinessProbe:
         httpGet:
           path: /
@@ -68,9 +68,9 @@ service-template:
     parentRefs:
       - name: main-gateway
         namespace: gateway-infra
-        sectionName: http
+        sectionName: https
     hostnames:
-      - "tzviewer.testzeus.app"
+      - "tzviewer.prod.testzeus.app"
     rules:
       - matches:
           - path:

From 4bf8b4943f50e10767861b1b5e42f49804878dc5 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Tue, 17 Mar 2026 18:58:05 +0530
Subject: [PATCH 14/28] fix(ci/helm): use dev config for main-prod push, prod
 only on manual deploy; update deprecated Helm flag

---
 .github/workflows/deploy.yaml | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 4bbefcc7d0384..167f8a56f698e 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -51,8 +51,8 @@ jobs:
         id: auth
         uses: google-github-actions/auth@v2
         with:
-          workload_identity_provider: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
-          service_account: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+          workload_identity_provider: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
           token_format: access_token
 
       - name: Setup gcloud
@@ -74,8 +74,8 @@ jobs:
         id: meta
         run: |
           IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}"
-          PROJECT_ID="${{ github.ref == 'refs/heads/main-prod' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
-          GAR_REPO="${{ github.ref == 'refs/heads/main-prod' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
+          PROJECT_ID="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
+          GAR_REPO="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
           IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"
           echo "image_tag=${IMAGE_TAG}" >>"${GITHUB_OUTPUT}"
           echo "image_repo=${IMAGE_REPO}" >>"${GITHUB_OUTPUT}"
@@ -91,19 +91,19 @@ jobs:
           cache-to: type=gha,mode=max
 
   helm4-compat:
-    if: github.ref == 'refs/heads/main-prod'
+    if: github.ref == 'refs/heads/main-prod' && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true'))
     needs: build
     runs-on: ubuntu-latest
     env:
-      TARGET_ENV: ${{ github.ref == 'refs/heads/main-prod' && 'prod' || 'dev' }}
-      VALUES_FILE: ${{ github.ref == 'refs/heads/main-prod' && 'values-prod.yaml' || 'values-dev.yaml' }}
-      DEPLOY_NAMESPACE: ${{ github.ref == 'refs/heads/main-prod' && 'testzeus-prod' || 'testzeus-dev' }}
-      GKE_CLUSTER: ${{ github.ref == 'refs/heads/main-prod' && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
-      GKE_LOCATION: ${{ github.ref == 'refs/heads/main-prod' && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
-      GCP_PROJECT_ID: ${{ github.ref == 'refs/heads/main-prod' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
-      GAR_HELM_REPOSITORY: ${{ github.ref == 'refs/heads/main-prod' && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
-      GCP_SA: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
-      GCP_WIF_PROVIDER: ${{ github.ref == 'refs/heads/main-prod' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'prod' || 'dev' }}
+      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'values-prod.yaml' || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'testzeus-prod' || 'testzeus-dev' }}
+      GKE_CLUSTER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
+      GKE_LOCATION: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
+      GCP_PROJECT_ID: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
+      GAR_HELM_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
+      GCP_SA: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+      GCP_WIF_PROVIDER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
     steps:
       - uses: actions/checkout@v4
 
@@ -172,7 +172,7 @@ jobs:
             --namespace "${DEPLOY_NAMESPACE}" \
             --create-namespace \
             --install \
-            --dry-run \
+            --dry-run=client \
             --server-side=false \
             --debug
 

From 75dd6603e08b8d2b125f944f579db9f9c7b00d55 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Tue, 17 Mar 2026 19:04:48 +0530
Subject: [PATCH 15/28] fix(helm): correct HTTPRoute path format to match other
 services

---
 helm/values-dev.yaml  | 5 ++---
 helm/values-prod.yaml | 5 ++---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index 86474febfbca6..36de06674b6db 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -72,9 +72,8 @@ service-template:
       - "tzviewer.dev.testzeus.app"
     rules:
       - matches:
-          - path:
-              value: /
-              type: PathPrefix
+          - path: /
+            pathType: PathPrefix
 
   secrets:
     enabled: false # No secrets for trace-viewer yet
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index deb3789be89b5..14021291b3ea7 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -73,9 +73,8 @@ service-template:
       - "tzviewer.prod.testzeus.app"
     rules:
       - matches:
-          - path:
-              value: /
-              type: PathPrefix
+          - path: /
+            pathType: PathPrefix
 
   secrets:
     enabled: false # No secrets for trace-viewer yet

From 19aa96173ab6fb68177506980f1a0de67494223c Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Tue, 17 Mar 2026 19:19:19 +0530
Subject: [PATCH 16/28] fix(helm): align containerPort, env, probes, service
 port, and securityContext

---
 helm/values-dev.yaml             | 9 +--------
 helm/values-prod.yaml            | 9 +--------
 packages/trace-viewer/nginx.conf | 2 --
 3 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index 36de06674b6db..7b3904f581b87 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -47,14 +47,7 @@ service-template:
         initialDelaySeconds: 10
         periodSeconds: 20
         failureThreshold: 3
-      securityContext:
-        allowPrivilegeEscalation: false
-        runAsNonRoot: true
-        runAsUser: 101  # nginx user
-        runAsGroup: 101
-        capabilities:
-          drop:
-            - ALL
+      securityContext: {}
 
   service:
     enabled: true
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index 14021291b3ea7..91aa8743cc0c7 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -47,14 +47,7 @@ service-template:
         initialDelaySeconds: 10
         periodSeconds: 20
         failureThreshold: 3
-      securityContext:
-        allowPrivilegeEscalation: false
-        runAsNonRoot: true
-        runAsUser: 101  # nginx user
-        runAsGroup: 101
-        capabilities:
-          drop:
-            - ALL
+      securityContext: {}
 
   service:
     enabled: true
diff --git a/packages/trace-viewer/nginx.conf b/packages/trace-viewer/nginx.conf
index 3d88cf6f78d81..85faaa1471623 100644
--- a/packages/trace-viewer/nginx.conf
+++ b/packages/trace-viewer/nginx.conf
@@ -31,5 +31,3 @@ server {
         try_files $uri $uri/ /index.html;
     }
 }
-
-

From cc683d16001cea3e2ff5fd9116221206112b70da Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Fri, 20 Mar 2026 21:28:22 +0530
Subject: [PATCH 17/28] ci: configure dynamic GKE runner IP whitelist and
 dry-run client

---
 .github/workflows/deploy.yaml | 46 +++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 167f8a56f698e..d327a9b7fb3ab 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -265,6 +265,28 @@ jobs:
           location: ${{ env.GKE_LOCATION }}
           project_id: ${{ env.GCP_PROJECT_ID }}
 
+      
+#       - name: Whitelist Runner IP
+#         run: |
+#           RUNNER_IP=$(curl -sf https://api.ipify.org) || { echo "Failed to get runner IP"; exit 1; }
+#           echo "RUNNER_IP=${RUNNER_IP}" >> $GITHUB_ENV
+#           echo "Whitelisting IP: ${RUNNER_IP}"
+
+#           EXISTING_RANGES=$(gcloud container clusters describe ${{ env.GKE_CLUSTER }} \
+#             --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#             --format="value(masterAuthorizedNetworksConfig.cidrBlocks[].cidrBlock)" \
+#             | tr '\n' ',' | tr ';' ',' | sed 's/,$//; s/,,*/,/g')
+          
+#           if [[ $EXISTING_RANGES == *"${RUNNER_IP}/32"* ]]; then
+#             echo "IP already whitelisted."
+#           else
+#             NEW_RANGES="${EXISTING_RANGES}${EXISTING_RANGES:+,}${RUNNER_IP}/32"
+#             gcloud container clusters update ${{ env.GKE_CLUSTER }} \
+#               --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#               --enable-master-authorized-networks \
+#               --master-authorized-networks "$NEW_RANGES"
+#           fi
+
       - name: Login Helm to GAR OCI registry
         run: |
           gcloud auth print-access-token | \
@@ -293,3 +315,27 @@ jobs:
             --rollback-on-failure \
             --server-side=false \
             --timeout 5m
+
+#       - name: Cleanup Runner IP
+#         if: always()
+#         run: |
+#           if [ -n "${RUNNER_IP}" ]; then
+#             echo "Removing Runner IP: ${RUNNER_IP}"
+#             EXISTING_RANGES=$(gcloud container clusters describe ${{ env.GKE_CLUSTER }} \
+#               --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#               --format="value(masterAuthorizedNetworksConfig.cidrBlocks[].cidrBlock)" \
+#               | tr '\n' ',' | tr ';' ',' | sed 's/,$//; s/,,*/,/g')
+            
+#             REMAINING_RANGES=$(echo "$EXISTING_RANGES" | sed "s/${RUNNER_IP}\/32//g; s/,,*/,/g; s/^,//; s/,$//")
+            
+#             if [ -n "$REMAINING_RANGES" ]; then
+#               gcloud container clusters update ${{ env.GKE_CLUSTER }} \
+#                 --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#                 --enable-master-authorized-networks \
+#                 --master-authorized-networks "$REMAINING_RANGES"
+#             else
+#               gcloud container clusters update ${{ env.GKE_CLUSTER }} \
+#                 --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#                 --no-enable-master-authorized-networks
+#             fi
+#           fi

From c23627127a1a1e2f1f4967dfaba63ae62a2532d5 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Thu, 26 Mar 2026 16:12:21 +0530
Subject: [PATCH 18/28] Persist runtime GSA mapping in Helm values

---
 helm/README.md        | 20 ++++++++++++++++++++
 helm/values-dev.yaml  |  2 ++
 helm/values-prod.yaml |  2 ++
 3 files changed, 24 insertions(+)
 create mode 100644 helm/README.md

diff --git a/helm/README.md b/helm/README.md
new file mode 100644
index 0000000000000..08119e3fcce2f
--- /dev/null
+++ b/helm/README.md
@@ -0,0 +1,20 @@
+# Helm Documentation: testzeus-traceviewer
+
+This directory contains the Helm chart for deploying `testzeus-traceviewer` to GKE.
+
+## Deployment
+
+### Development
+```bash
+helm upgrade --install traceviewer ./helm -f ./helm/values-dev.yaml --namespace testzeus-dev
+```
+
+### Production
+```bash
+helm upgrade --install traceviewer ./helm -f ./helm/values-prod.yaml --namespace testzeus-prod
+```
+
+## Infrastructure Notes
+
+- **Ingress**: Managed through Gateway API in the target environment.
+- **Workload Identity**: `values-dev.yaml` and `values-prod.yaml` annotate the Kubernetes service account with the shared runtime GSA for each environment. The matching IAM `roles/iam.workloadIdentityUser` binding must exist in GCP.
diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
index 7b3904f581b87..06bd640218c6e 100644
--- a/helm/values-dev.yaml
+++ b/helm/values-dev.yaml
@@ -6,6 +6,8 @@ service-template:
     create: true
     name: "testzeus-traceviewer-sa"
     automount: false  # nginx does not call the K8s API
+    annotations:
+      iam.gke.io/gcp-service-account: "gke-runtime-dev@dev-testzeus.iam.gserviceaccount.com"
 
   podSecurityContext:
     seccompProfile:
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
index 91aa8743cc0c7..8b072c53359dd 100644
--- a/helm/values-prod.yaml
+++ b/helm/values-prod.yaml
@@ -6,6 +6,8 @@ service-template:
     create: true
     name: "testzeus-traceviewer-sa"
     automount: false  # nginx does not call the K8s API
+    annotations:
+      iam.gke.io/gcp-service-account: "gke-runtime-prod@prod-testarmy.iam.gserviceaccount.com"
 
   podSecurityContext:
     seccompProfile:

From e90a26706ec7efa45bf9f3353a16520e961c1b98 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Fri, 27 Mar 2026 11:47:52 +0530
Subject: [PATCH 19/28] Let traceviewer runtime GSA come from Helm values

---
 .github/workflows/deploy.yaml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index d327a9b7fb3ab..bdd9266414020 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -148,7 +148,6 @@ jobs:
             -f "${CHART_DIR}/${VALUES_FILE}" \
             --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
             --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
-            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ env.GCP_SA }} \
             > rendered-helm4.yaml
 
       - name: Guard rendered manifest fields
@@ -168,7 +167,6 @@ jobs:
             -f "${CHART_DIR}/${VALUES_FILE}" \
             --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
             --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
-            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ env.GCP_SA }} \
             --namespace "${DEPLOY_NAMESPACE}" \
             --create-namespace \
             --install \
@@ -226,7 +224,6 @@ jobs:
             -f "${CHART_DIR}/values-dev.yaml" \
             --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
             --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
-            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ secrets.GCP_SA_DEV }} \
             --namespace "testzeus-dev" \
             --create-namespace \
             --install \
@@ -307,7 +304,6 @@ jobs:
             -f "${CHART_DIR}/values-prod.yaml" \
             --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
             --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
-            --set-string service-template.serviceAccount.annotations.iam\\.gke\\.io/gcp-service-account=${{ secrets.GCP_SA_PROD }} \
             --namespace "testzeus-prod" \
             --create-namespace \
             --install \

From c2940871b79509b5f4bc806ea80782de1dba929e Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Tue, 31 Mar 2026 00:54:43 +0530
Subject: [PATCH 20/28] Add dev2/dev3 values

---
 helm/values-dev2.yaml | 74 +++++++++++++++++++++++++++++++++++++++++++
 helm/values-dev3.yaml | 74 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 148 insertions(+)
 create mode 100644 helm/values-dev2.yaml
 create mode 100644 helm/values-dev3.yaml

diff --git a/helm/values-dev2.yaml b/helm/values-dev2.yaml
new file mode 100644
index 0000000000000..38e4591faa33b
--- /dev/null
+++ b/helm/values-dev2.yaml
@@ -0,0 +1,74 @@
+service-template:
+  fullnameOverride: "testzeus-traceviewer"
+  replicaCount: 1
+
+  serviceAccount:
+    create: true
+    name: "testzeus-traceviewer-sa"
+    automount: false  # nginx does not call the K8s API
+    annotations:
+      iam.gke.io/gcp-service-account: "gke-runtime-dev2@dev2-testzeus.iam.gserviceaccount.com"
+
+  podSecurityContext:
+    seccompProfile:
+      type: RuntimeDefault
+
+  containers:
+    - name: trace-viewer
+      image:
+        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_DEV2/GAR_DOCKER_REPOSITORY_DEV2"
+        tag: latest
+        pullPolicy: Always
+      ports:
+        - containerPort: 80
+      env:
+        - name: HOST
+          value: "eyJhbGciOiJFUzI1NiIsImtpZCI6IkVsWTBtZyJ9.eyJhdWQiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJleHAiOjQ5MjgzMTM3ODEsImdycGNfYnJvYWRjYXN0X2FkZHJlc3MiOiJoYXRjaGV0LXN0YWNrLWVuZ2luZTo3MDcwIiwiaWF0IjoxNzc0NzEzNzgxLCJpc3MiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJzZXJ2ZXJfdXJsIjoiaHR0cHM6Ly9obC5kZXYudGVzdHpldXMuYXBwIiwic3ViIjoiNzA3ZDA4NTUtODBhYi00ZTFmLWExNTYtZjFjNDU0NmNiZjUyIiwidG9rZW5faWQiOiJkN2VmNzMzNC00MWRmLTQwNTMtOTA3Ny03ZWQ3OWYwNTg4YjAifQ.trW5OLZVZfBQAC_cNiG3AjFLzUzb9bEfTnOQHvPveRn8B--o6_RgWMk2SwFClcoi4k_PloLRyae8hRHBK0OaPg"
+        - name: PORT
+          value: "80"
+        - name: NODE_ENV
+          value: development
+      resources:
+        requests:
+          cpu: "250m"
+          memory: "512Mi"
+        limits:
+          cpu: "500m"
+          memory: "512Mi"
+      readinessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        failureThreshold: 3
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 10
+        periodSeconds: 20
+        failureThreshold: 3
+      securityContext: {}
+
+  service:
+    enabled: true
+    type: ClusterIP
+    port: 80
+    targetPort: 80
+
+  httpRoute:
+    enabled: true
+    parentRefs:
+      - name: testzeus-gateway
+        namespace: testzeus
+        sectionName: https
+    hostnames:
+      - "tzviewer.dev2.testzeus.app"
+    rules:
+      - matches:
+          - path: /
+            pathType: PathPrefix
+
+  secrets:
+    enabled: false # No secrets for trace-viewer yet
diff --git a/helm/values-dev3.yaml b/helm/values-dev3.yaml
new file mode 100644
index 0000000000000..e2585572cb09f
--- /dev/null
+++ b/helm/values-dev3.yaml
@@ -0,0 +1,74 @@
+service-template:
+  fullnameOverride: "testzeus-traceviewer"
+  replicaCount: 1
+
+  serviceAccount:
+    create: true
+    name: "testzeus-traceviewer-sa"
+    automount: false  # nginx does not call the K8s API
+    annotations:
+      iam.gke.io/gcp-service-account: "gke-runtime-dev3@dev3-testzeus.iam.gserviceaccount.com"
+
+  podSecurityContext:
+    seccompProfile:
+      type: RuntimeDefault
+
+  containers:
+    - name: trace-viewer
+      image:
+        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_DEV3/GAR_DOCKER_REPOSITORY_DEV3"
+        tag: latest
+        pullPolicy: Always
+      ports:
+        - containerPort: 80
+      env:
+        - name: HOST
+          value: "eyJhbGciOiJFUzI1NiIsImtpZCI6IkVsWTBtZyJ9.eyJhdWQiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJleHAiOjQ5MjgzMTM3ODEsImdycGNfYnJvYWRjYXN0X2FkZHJlc3MiOiJoYXRjaGV0LXN0YWNrLWVuZ2luZTo3MDcwIiwiaWF0IjoxNzc0NzEzNzgxLCJpc3MiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJzZXJ2ZXJfdXJsIjoiaHR0cHM6Ly9obC5kZXYudGVzdHpldXMuYXBwIiwic3ViIjoiNzA3ZDA4NTUtODBhYi00ZTFmLWExNTYtZjFjNDU0NmNiZjUyIiwidG9rZW5faWQiOiJkN2VmNzMzNC00MWRmLTQwNTMtOTA3Ny03ZWQ3OWYwNTg4YjAifQ.trW5OLZVZfBQAC_cNiG3AjFLzUzb9bEfTnOQHvPveRn8B--o6_RgWMk2SwFClcoi4k_PloLRyae8hRHBK0OaPg"
+        - name: PORT
+          value: "80"
+        - name: NODE_ENV
+          value: development
+      resources:
+        requests:
+          cpu: "250m"
+          memory: "512Mi"
+        limits:
+          cpu: "500m"
+          memory: "512Mi"
+      readinessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 5
+        periodSeconds: 10
+        failureThreshold: 3
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 80
+        initialDelaySeconds: 10
+        periodSeconds: 20
+        failureThreshold: 3
+      securityContext: {}
+
+  service:
+    enabled: true
+    type: ClusterIP
+    port: 80
+    targetPort: 80
+
+  httpRoute:
+    enabled: true
+    parentRefs:
+      - name: testzeus-gateway
+        namespace: testzeus
+        sectionName: https
+    hostnames:
+      - "tzviewer.dev3.testzeus.app"
+    rules:
+      - matches:
+          - path: /
+            pathType: PathPrefix
+
+  secrets:
+    enabled: false # No secrets for trace-viewer yet

From 1cdf6d0885c409e4c6bb675a9dcb51cb706f4615 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Tue, 31 Mar 2026 13:34:09 +0530
Subject: [PATCH 21/28] Add dev2/dev3 workflow dispatch support

---
 .github/workflows/deploy.yaml | 32 +++++++++++++++++++++++++-------
 helm/README.md                | 14 ++++++++++++++
 2 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index bdd9266414020..b0597b51b6467 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -23,6 +23,18 @@ on:
         required: true
         type: boolean
         default: false
+      target_env:
+        description: "Deploy environment (dev2/dev3)"
+        required: false
+        default: "dev2"
+        type: choice
+        options:
+          - dev2
+          - dev3
+      branch:
+        description: "Branch to deploy (for dev2/dev3)"
+        required: false
+        default: "main-prod"
 
 permissions:
   contents: read
@@ -46,6 +58,8 @@ jobs:
       image_repo: ${{ steps.meta.outputs.image_repo }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || github.ref }}
 
       - name: Authenticate to Google Cloud
         id: auth
@@ -91,13 +105,13 @@ jobs:
           cache-to: type=gha,mode=max
 
   helm4-compat:
-    if: github.ref == 'refs/heads/main-prod' && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true'))
+    if: github.ref == 'refs/heads/main-prod' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build
     runs-on: ubuntu-latest
     env:
-      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'prod' || 'dev' }}
-      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'values-prod.yaml' || 'values-dev.yaml' }}
-      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'testzeus-prod' || 'testzeus-dev' }}
+      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && github.event.inputs.target_env) || 'dev' }}
+      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'values-prod.yaml' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('values-{0}.yaml', github.event.inputs.target_env)) || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'testzeus-prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('testzeus-{0}', github.event.inputs.target_env)) || 'testzeus-dev' }}
       GKE_CLUSTER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
       GKE_LOCATION: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
       GCP_PROJECT_ID: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
@@ -175,7 +189,7 @@ jobs:
             --debug
 
   deploy-dev:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main-prod'
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev2' || github.event.inputs.target_env == 'dev3'))
     needs: [build, helm4-compat]
     runs-on: ubuntu-latest
     environment: dev
@@ -183,8 +197,12 @@ jobs:
       GKE_CLUSTER: ${{ vars.GKE_DEV_CLUSTER }}
       GKE_LOCATION: ${{ vars.GKE_DEV_LOCATION }}
       GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_DEV }}
+      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && format('values-{0}.yaml', github.event.inputs.target_env) || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && format('testzeus-{0}', github.event.inputs.target_env) || 'testzeus-dev' }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || github.ref }}
 
       - name: Set up Helm
         uses: azure/setup-helm@v4
@@ -221,10 +239,10 @@ jobs:
       - name: Helm deploy to dev
         run: |
           helm upgrade "${SERVICE_NAME}" "${CHART_DIR}" \
-            -f "${CHART_DIR}/values-dev.yaml" \
+            -f "${CHART_DIR}/${VALUES_FILE}" \
             --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
             --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
-            --namespace "testzeus-dev" \
+            --namespace "${DEPLOY_NAMESPACE}" \
             --create-namespace \
             --install \
             --wait \
diff --git a/helm/README.md b/helm/README.md
index 08119e3fcce2f..e9f0215c47b15 100644
--- a/helm/README.md
+++ b/helm/README.md
@@ -18,3 +18,17 @@ helm upgrade --install traceviewer ./helm -f ./helm/values-prod.yaml --namespace
 
 - **Ingress**: Managed through Gateway API in the target environment.
 - **Workload Identity**: `values-dev.yaml` and `values-prod.yaml` annotate the Kubernetes service account with the shared runtime GSA for each environment. The matching IAM `roles/iam.workloadIdentityUser` binding must exist in GCP.
+
+## Dev2/Dev3 Deploys
+
+To deploy into the shared dev2/dev3 namespaces:
+
+```bash
+# Dev2
+helm upgrade <release-name> . -f values-dev2.yaml -n testzeus-dev2 --install
+
+# Dev3
+helm upgrade <release-name> . -f values-dev3.yaml -n testzeus-dev3 --install
+```
+
+These values files are intended for branch overrides in dev2/dev3 while `dev` remains the fixed dev environment.

From 716e6459aa69dcdda690ba584aba24718a9d8490 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Tue, 31 Mar 2026 13:55:06 +0530
Subject: [PATCH 22/28] Add dev1/dev2/dev3 deployment guide

---
 helm/README.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/helm/README.md b/helm/README.md
index e9f0215c47b15..6853f1ee49468 100644
--- a/helm/README.md
+++ b/helm/README.md
@@ -32,3 +32,29 @@ helm upgrade <release-name> . -f values-dev3.yaml -n testzeus-dev3 --install
 ```
 
 These values files are intended for branch overrides in dev2/dev3 while `dev` remains the fixed dev environment.
+
+## Deployment Guide: dev / dev2 / dev3
+
+### dev (testzeus-dev)
+- **Branch:** `dev` (fixed)
+- **Trigger:** push to `dev`
+- **Namespace:** `testzeus-dev`
+- **Values:** `values-dev.yaml`
+
+### dev2 / dev3 (branch overrides)
+- **Trigger:** GitHub Actions `workflow_dispatch`
+- **Namespaces:** `testzeus-dev2`, `testzeus-dev3`
+- **Values:** `values-dev2.yaml`, `values-dev3.yaml`
+- **Branch:** any branch provided in the workflow inputs
+
+**Workflow inputs:**
+- `target_env`: `dev2` or `dev3`
+- `branch`: the branch you want to deploy (e.g. `feature/foo`)
+
+**Example:**
+- `target_env=dev2`, `branch=feature/foo`
+- `target_env=dev3`, `branch=bugfix/streaming`
+
+Notes:
+- `dev` remains fixed to `testzeus-dev` and always deploys from `dev` branch.
+- `dev2`/`dev3` are intended for branch testing only.

From 3690ce23f0283f99adbcd6819171a766ffeda1e8 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Wed, 1 Apr 2026 13:44:51 +0530
Subject: [PATCH 23/28] updated helm workflow

---
 .github/workflows/deploy.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index b0597b51b6467..382ed53337d3d 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -87,7 +87,8 @@ jobs:
       - name: Build image metadata
         id: meta
         run: |
-          IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}"
+          TS="$(date -u +%Y%m%d%H%M%S)"
+          IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}-$TS"
           PROJECT_ID="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
           GAR_REPO="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
           IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"

From 85593e6a0295eb3383f34dccb33a3d64f2d1f5c5 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Wed, 1 Apr 2026 14:44:12 +0530
Subject: [PATCH 24/28] Add workflow_dispatch workflow

---
 .github/workflows/deploy.yaml | 356 ++++++++++++++++++++++++++++++++++
 1 file changed, 356 insertions(+)
 create mode 100644 .github/workflows/deploy.yaml

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
new file mode 100644
index 0000000000000..382ed53337d3d
--- /dev/null
+++ b/.github/workflows/deploy.yaml
@@ -0,0 +1,356 @@
+name: Build and Deploy
+
+on:
+  push:
+    branches:
+      - main-prod
+    paths:
+      - .github/workflows/deploy.yaml
+      - helm/**
+      - package.json
+      - package-lock.json
+      - packages/injected/**
+      - packages/playwright-core/**
+      - packages/protocol/**
+      - packages/trace/**
+      - packages/trace-viewer/**
+      - packages/web/**
+      - utils/build/**
+  workflow_dispatch:
+    inputs:
+      deploy_prod:
+        description: "Deploy to production"
+        required: true
+        type: boolean
+        default: false
+      target_env:
+        description: "Deploy environment (dev2/dev3)"
+        required: false
+        default: "dev2"
+        type: choice
+        options:
+          - dev2
+          - dev3
+      branch:
+        description: "Branch to deploy (for dev2/dev3)"
+        required: false
+        default: "main-prod"
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  SERVICE_NAME: traceviewer
+  APP_DIR: .
+  DOCKERFILE: packages/trace-viewer/Dockerfile
+  CHART_DIR: helm
+  GAR_LOCATION: ${{ vars.GAR_LOCATION }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+      image_repo: ${{ steps.meta.outputs.image_repo }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || github.ref }}
+
+      - name: Authenticate to Google Cloud
+        id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+          token_format: access_token
+
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+
+      - name: Login to GAR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GAR_LOCATION }}-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.auth.outputs.access_token }}
+
+      - name: Build image metadata
+        id: meta
+        run: |
+          TS="$(date -u +%Y%m%d%H%M%S)"
+          IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}-$TS"
+          PROJECT_ID="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
+          GAR_REPO="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
+          IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"
+          echo "image_tag=${IMAGE_TAG}" >>"${GITHUB_OUTPUT}"
+          echo "image_repo=${IMAGE_REPO}" >>"${GITHUB_OUTPUT}"
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ env.APP_DIR }}
+          file: ${{ env.DOCKERFILE }}
+          push: true
+          tags: ${{ steps.meta.outputs.image_repo }}:${{ steps.meta.outputs.image_tag }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  helm4-compat:
+    if: github.ref == 'refs/heads/main-prod' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    needs: build
+    runs-on: ubuntu-latest
+    env:
+      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && github.event.inputs.target_env) || 'dev' }}
+      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'values-prod.yaml' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('values-{0}.yaml', github.event.inputs.target_env)) || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'testzeus-prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('testzeus-{0}', github.event.inputs.target_env)) || 'testzeus-dev' }}
+      GKE_CLUSTER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
+      GKE_LOCATION: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
+      GCP_PROJECT_ID: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
+      GAR_HELM_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
+      GCP_SA: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+      GCP_WIF_PROVIDER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Helm 4 (compat check)
+        uses: azure/setup-helm@v4
+        with:
+          version: v4.0.0
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ env.GCP_WIF_PROVIDER }}
+          service_account: ${{ env.GCP_SA }}
+
+      - name: Get GKE credentials
+        uses: google-github-actions/get-gke-credentials@v2
+        with:
+          cluster_name: ${{ env.GKE_CLUSTER }}
+          location: ${{ env.GKE_LOCATION }}
+          project_id: ${{ env.GCP_PROJECT_ID }}
+
+      - name: Login Helm to GAR OCI registry
+        run: |
+          gcloud auth print-access-token | \
+            helm registry login -u oauth2accesstoken --password-stdin \
+            "${GAR_LOCATION}-docker.pkg.dev"
+
+      - name: Set Helm dependency repository (target env)
+        run: |
+          CHART_REPO="oci://${GAR_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_HELM_REPOSITORY}"
+          sed -i "/- name: service-template/,/repository:/ s#repository: \".*\"#repository: \"${CHART_REPO}\"#" "${CHART_DIR}/Chart.yaml"
+
+      - name: Helm dependency update (Helm 4)
+        run: helm dependency update "${CHART_DIR}"
+
+      - name: Helm lint (Helm 4)
+        run: helm lint "${CHART_DIR}" -f "${CHART_DIR}/${VALUES_FILE}"
+
+      - name: Helm template render (Helm 4)
+        run: |
+          helm template "${SERVICE_NAME}-helm4-compat" "${CHART_DIR}" \
+            -f "${CHART_DIR}/${VALUES_FILE}" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            > rendered-helm4.yaml
+
+      - name: Guard rendered manifest fields
+        run: |
+          if grep -nE '^[[:space:]]*(managedFields:|resourceVersion:|uid:|creationTimestamp:)$' rendered-helm4.yaml; then
+            echo "Forbidden metadata fields found in rendered output."
+            exit 1
+          fi
+          if grep -nE '^[[:space:]]*status:[[:space:]]*$' rendered-helm4.yaml; then
+            echo "Forbidden status field found in rendered output."
+            exit 1
+          fi
+
+      - name: Helm upgrade dry-run (Helm 4)
+        run: |
+          helm upgrade "${SERVICE_NAME}-helm4-compat" "${CHART_DIR}" \
+            -f "${CHART_DIR}/${VALUES_FILE}" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            --namespace "${DEPLOY_NAMESPACE}" \
+            --create-namespace \
+            --install \
+            --dry-run=client \
+            --server-side=false \
+            --debug
+
+  deploy-dev:
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev2' || github.event.inputs.target_env == 'dev3'))
+    needs: [build, helm4-compat]
+    runs-on: ubuntu-latest
+    environment: dev
+    env:
+      GKE_CLUSTER: ${{ vars.GKE_DEV_CLUSTER }}
+      GKE_LOCATION: ${{ vars.GKE_DEV_LOCATION }}
+      GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_DEV }}
+      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && format('values-{0}.yaml', github.event.inputs.target_env) || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && format('testzeus-{0}', github.event.inputs.target_env) || 'testzeus-dev' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || github.ref }}
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v4.0.0
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ secrets.GCP_SA_DEV }}
+
+      - name: Get GKE credentials
+        uses: google-github-actions/get-gke-credentials@v2
+        with:
+          cluster_name: ${{ env.GKE_CLUSTER }}
+          location: ${{ env.GKE_LOCATION }}
+          project_id: ${{ env.GCP_PROJECT_ID }}
+
+      - name: Login Helm to GAR OCI registry
+        run: |
+          gcloud auth print-access-token | \
+            helm registry login -u oauth2accesstoken --password-stdin \
+            "${GAR_LOCATION}-docker.pkg.dev"
+
+      - name: Set Helm dependency repository (dev)
+        run: |
+          CHART_REPO="oci://${GAR_LOCATION}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID_DEV }}/${{ vars.GAR_HELM_REPOSITORY_DEV }}"
+          sed -i "/- name: service-template/,/repository:/ s#repository: \".*\"#repository: \"${CHART_REPO}\"#" "${CHART_DIR}/Chart.yaml"
+
+      - name: Helm dependency update
+        run: helm dependency update "${CHART_DIR}"
+
+      - name: Helm deploy to dev
+        run: |
+          helm upgrade "${SERVICE_NAME}" "${CHART_DIR}" \
+            -f "${CHART_DIR}/${VALUES_FILE}" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            --namespace "${DEPLOY_NAMESPACE}" \
+            --create-namespace \
+            --install \
+            --wait \
+            --rollback-on-failure \
+            --server-side=false \
+            --timeout 5m
+
+  deploy-prod:
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main-prod' && github.event.inputs.deploy_prod == 'true'
+    needs: [build, helm4-compat]
+    runs-on: ubuntu-latest
+    environment: production
+    env:
+      GKE_CLUSTER: ${{ vars.GKE_PROD_CLUSTER }}
+      GKE_LOCATION: ${{ vars.GKE_PROD_LOCATION }}
+      GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID_PROD }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v4.0.0
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER_PROD }}
+          service_account: ${{ secrets.GCP_SA_PROD }}
+
+      - name: Get GKE credentials
+        uses: google-github-actions/get-gke-credentials@v2
+        with:
+          cluster_name: ${{ env.GKE_CLUSTER }}
+          location: ${{ env.GKE_LOCATION }}
+          project_id: ${{ env.GCP_PROJECT_ID }}
+
+      
+#       - name: Whitelist Runner IP
+#         run: |
+#           RUNNER_IP=$(curl -sf https://api.ipify.org) || { echo "Failed to get runner IP"; exit 1; }
+#           echo "RUNNER_IP=${RUNNER_IP}" >> $GITHUB_ENV
+#           echo "Whitelisting IP: ${RUNNER_IP}"
+
+#           EXISTING_RANGES=$(gcloud container clusters describe ${{ env.GKE_CLUSTER }} \
+#             --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#             --format="value(masterAuthorizedNetworksConfig.cidrBlocks[].cidrBlock)" \
+#             | tr '\n' ',' | tr ';' ',' | sed 's/,$//; s/,,*/,/g')
+          
+#           if [[ $EXISTING_RANGES == *"${RUNNER_IP}/32"* ]]; then
+#             echo "IP already whitelisted."
+#           else
+#             NEW_RANGES="${EXISTING_RANGES}${EXISTING_RANGES:+,}${RUNNER_IP}/32"
+#             gcloud container clusters update ${{ env.GKE_CLUSTER }} \
+#               --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#               --enable-master-authorized-networks \
+#               --master-authorized-networks "$NEW_RANGES"
+#           fi
+
+      - name: Login Helm to GAR OCI registry
+        run: |
+          gcloud auth print-access-token | \
+            helm registry login -u oauth2accesstoken --password-stdin \
+            "${GAR_LOCATION}-docker.pkg.dev"
+
+      - name: Set Helm dependency repository (prod)
+        run: |
+          CHART_REPO="oci://${GAR_LOCATION}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID_PROD }}/${{ vars.GAR_HELM_REPOSITORY_PROD }}"
+          sed -i "/- name: service-template/,/repository:/ s#repository: \".*\"#repository: \"${CHART_REPO}\"#" "${CHART_DIR}/Chart.yaml"
+
+      - name: Helm dependency update
+        run: helm dependency update "${CHART_DIR}"
+
+      - name: Helm deploy to prod
+        run: |
+          helm upgrade "${SERVICE_NAME}" "${CHART_DIR}" \
+            -f "${CHART_DIR}/values-prod.yaml" \
+            --set-string service-template.containers[0].image.repository=${{ needs.build.outputs.image_repo }} \
+            --set-string service-template.containers[0].image.tag=${{ needs.build.outputs.image_tag }} \
+            --namespace "testzeus-prod" \
+            --create-namespace \
+            --install \
+            --wait \
+            --rollback-on-failure \
+            --server-side=false \
+            --timeout 5m
+
+#       - name: Cleanup Runner IP
+#         if: always()
+#         run: |
+#           if [ -n "${RUNNER_IP}" ]; then
+#             echo "Removing Runner IP: ${RUNNER_IP}"
+#             EXISTING_RANGES=$(gcloud container clusters describe ${{ env.GKE_CLUSTER }} \
+#               --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#               --format="value(masterAuthorizedNetworksConfig.cidrBlocks[].cidrBlock)" \
+#               | tr '\n' ',' | tr ';' ',' | sed 's/,$//; s/,,*/,/g')
+            
+#             REMAINING_RANGES=$(echo "$EXISTING_RANGES" | sed "s/${RUNNER_IP}\/32//g; s/,,*/,/g; s/^,//; s/,$//")
+            
+#             if [ -n "$REMAINING_RANGES" ]; then
+#               gcloud container clusters update ${{ env.GKE_CLUSTER }} \
+#                 --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#                 --enable-master-authorized-networks \
+#                 --master-authorized-networks "$REMAINING_RANGES"
+#             else
+#               gcloud container clusters update ${{ env.GKE_CLUSTER }} \
+#                 --location ${{ env.GKE_LOCATION }} --project ${{ env.GCP_PROJECT_ID }} \
+#                 --no-enable-master-authorized-networks
+#             fi
+#           fi

From 13dcccf1c26cfb5852e761107bc2b16c0078ab7f Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Wed, 1 Apr 2026 16:30:28 +0530
Subject: [PATCH 25/28] updated helm workflow

---
 .github/workflows/deploy.yaml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 382ed53337d3d..047f7ba5a0131 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -1,4 +1,4 @@
-name: Build and Deploy
+name: Helm - GKE workflow
 
 on:
   push:
@@ -24,15 +24,16 @@ on:
         type: boolean
         default: false
       target_env:
-        description: "Deploy environment (dev2/dev3)"
+        description: "Deploy environment (dev/dev2/dev3)"
         required: false
-        default: "dev2"
+        default: "dev"
         type: choice
         options:
+          - dev
           - dev2
           - dev3
       branch:
-        description: "Branch to deploy (for dev2/dev3)"
+        description: "Branch to deploy (for dev/dev2/dev3)"
         required: false
         default: "main-prod"
 
@@ -354,3 +355,5 @@ jobs:
 #                 --no-enable-master-authorized-networks
 #             fi
 #           fi
+
+

From af02ab7a07c849d556127cea12df5e1f7598a264 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Wed, 1 Apr 2026 16:57:17 +0530
Subject: [PATCH 26/28] updated helm values

---
 .github/workflows/deploy.yaml | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 047f7ba5a0131..e740e327963a1 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -24,7 +24,7 @@ on:
         type: boolean
         default: false
       target_env:
-        description: "Deploy environment (dev/dev2/dev3)"
+        description: "Deploy environment (dev/dev2/dev3/main-prod)"
         required: false
         default: "dev"
         type: choice
@@ -32,6 +32,7 @@ on:
           - dev
           - dev2
           - dev3
+          - main-prod
       branch:
         description: "Branch to deploy (for dev/dev2/dev3)"
         required: false
@@ -66,8 +67,8 @@ jobs:
         id: auth
         uses: google-github-actions/auth@v2
         with:
-          workload_identity_provider: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
-          service_account: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+          workload_identity_provider: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
           token_format: access_token
 
       - name: Setup gcloud
@@ -90,8 +91,8 @@ jobs:
         run: |
           TS="$(date -u +%Y%m%d%H%M%S)"
           IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}-$TS"
-          PROJECT_ID="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
-          GAR_REPO="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
+          PROJECT_ID="${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
+          GAR_REPO="${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
           IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"
           echo "image_tag=${IMAGE_TAG}" >>"${GITHUB_OUTPUT}"
           echo "image_repo=${IMAGE_REPO}" >>"${GITHUB_OUTPUT}"
@@ -111,15 +112,15 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     env:
-      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && github.event.inputs.target_env) || 'dev' }}
-      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'values-prod.yaml' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('values-{0}.yaml', github.event.inputs.target_env)) || 'values-dev.yaml' }}
-      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'testzeus-prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('testzeus-{0}', github.event.inputs.target_env)) || 'testzeus-dev' }}
-      GKE_CLUSTER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
-      GKE_LOCATION: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
-      GCP_PROJECT_ID: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
-      GAR_HELM_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
-      GCP_SA: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
-      GCP_WIF_PROVIDER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && 'prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && github.event.inputs.target_env) || 'dev' }}
+      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && 'values-prod.yaml' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('values-{0}.yaml', github.event.inputs.target_env)) || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && 'testzeus-prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('testzeus-{0}', github.event.inputs.target_env)) || 'testzeus-dev' }}
+      GKE_CLUSTER: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
+      GKE_LOCATION: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
+      GCP_PROJECT_ID: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
+      GAR_HELM_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
+      GCP_SA: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+      GCP_WIF_PROVIDER: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
     steps:
       - uses: actions/checkout@v4
 
@@ -191,7 +192,7 @@ jobs:
             --debug
 
   deploy-dev:
-    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev2' || github.event.inputs.target_env == 'dev3'))
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev' || github.event.inputs.target_env == 'dev2' || github.event.inputs.target_env == 'dev3'))
     needs: [build, helm4-compat]
     runs-on: ubuntu-latest
     environment: dev
@@ -253,7 +254,7 @@ jobs:
             --timeout 5m
 
   deploy-prod:
-    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main-prod' && github.event.inputs.deploy_prod == 'true'
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main-prod' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod')
     needs: [build, helm4-compat]
     runs-on: ubuntu-latest
     environment: production

From 4772d912a03b63a240221d4f653efd21dae957cd Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Wed, 1 Apr 2026 19:00:04 +0530
Subject: [PATCH 27/28] updated helm workflow

---
 .github/workflows/deploy.yaml | 40 ++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 382ed53337d3d..d7b16070ed5e7 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -1,4 +1,4 @@
-name: Build and Deploy
+name: Helm - GKE workflow
 
 on:
   push:
@@ -24,15 +24,17 @@ on:
         type: boolean
         default: false
       target_env:
-        description: "Deploy environment (dev2/dev3)"
+        description: "Deploy environment (dev/dev2/dev3/main-prod)"
         required: false
-        default: "dev2"
+        default: "dev"
         type: choice
         options:
+          - dev
           - dev2
           - dev3
+          - main-prod
       branch:
-        description: "Branch to deploy (for dev2/dev3)"
+        description: "Branch to deploy (for dev/dev2/dev3/main-prod)"
         required: false
         default: "main-prod"
 
@@ -65,8 +67,8 @@ jobs:
         id: auth
         uses: google-github-actions/auth@v2
         with:
-          workload_identity_provider: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
-          service_account: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+          workload_identity_provider: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+          service_account: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
           token_format: access_token
 
       - name: Setup gcloud
@@ -89,8 +91,8 @@ jobs:
         run: |
           TS="$(date -u +%Y%m%d%H%M%S)"
           IMAGE_TAG="${GITHUB_SHA}-${GITHUB_RUN_ATTEMPT}-$TS"
-          PROJECT_ID="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
-          GAR_REPO="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
+          PROJECT_ID="${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}"
+          GAR_REPO="${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GAR_DOCKER_REPOSITORY_PROD || vars.GAR_DOCKER_REPOSITORY_DEV }}"
           IMAGE_REPO="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${GAR_REPO}/${SERVICE_NAME}"
           echo "image_tag=${IMAGE_TAG}" >>"${GITHUB_OUTPUT}"
           echo "image_repo=${IMAGE_REPO}" >>"${GITHUB_OUTPUT}"
@@ -110,15 +112,15 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     env:
-      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && github.event.inputs.target_env) || 'dev' }}
-      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'values-prod.yaml' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('values-{0}.yaml', github.event.inputs.target_env)) || 'values-dev.yaml' }}
-      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && 'testzeus-prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('testzeus-{0}', github.event.inputs.target_env)) || 'testzeus-dev' }}
-      GKE_CLUSTER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
-      GKE_LOCATION: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
-      GCP_PROJECT_ID: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
-      GAR_HELM_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
-      GCP_SA: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
-      GCP_WIF_PROVIDER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'true' && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
+      TARGET_ENV: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && 'prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && github.event.inputs.target_env) || 'dev' }}
+      VALUES_FILE: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && 'values-prod.yaml' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('values-{0}.yaml', github.event.inputs.target_env)) || 'values-dev.yaml' }}
+      DEPLOY_NAMESPACE: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && 'testzeus-prod' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target_env != '' && format('testzeus-{0}', github.event.inputs.target_env)) || 'testzeus-dev' }}
+      GKE_CLUSTER: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GKE_PROD_CLUSTER || vars.GKE_DEV_CLUSTER }}
+      GKE_LOCATION: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GKE_PROD_LOCATION || vars.GKE_DEV_LOCATION }}
+      GCP_PROJECT_ID: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GCP_PROJECT_ID_PROD || vars.GCP_PROJECT_ID_DEV }}
+      GAR_HELM_REPOSITORY: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && vars.GAR_HELM_REPOSITORY_PROD || vars.GAR_HELM_REPOSITORY_DEV }}
+      GCP_SA: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_SA_PROD || secrets.GCP_SA_DEV }}
+      GCP_WIF_PROVIDER: ${{ github.event_name == 'workflow_dispatch' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod') && secrets.GCP_WIF_PROVIDER_PROD || secrets.GCP_WIF_PROVIDER_DEV }}
     steps:
       - uses: actions/checkout@v4
 
@@ -190,7 +192,7 @@ jobs:
             --debug
 
   deploy-dev:
-    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev2' || github.event.inputs.target_env == 'dev3'))
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev' || github.event.inputs.target_env == 'dev2' || github.event.inputs.target_env == 'dev3'))
     needs: [build, helm4-compat]
     runs-on: ubuntu-latest
     environment: dev
@@ -252,7 +254,7 @@ jobs:
             --timeout 5m
 
   deploy-prod:
-    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main-prod' && github.event.inputs.deploy_prod == 'true'
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main-prod' && (github.event.inputs.deploy_prod == 'true' || github.event.inputs.target_env == 'main-prod')
     needs: [build, helm4-compat]
     runs-on: ubuntu-latest
     environment: production

From c6032558dc6f50403b29ef147638a8b57bca4142 Mon Sep 17 00:00:00 2001
From: akshayr237 <secops@testzeus.com>
Date: Wed, 1 Apr 2026 21:33:25 +0530
Subject: [PATCH 28/28] updated helm values

---
 .github/workflows/deploy.yaml               | 10 +++++-----
 helm/{values-dev2.yaml => values-dev4.yaml} |  8 ++++----
 helm/{values-dev3.yaml => values-dev5.yaml} |  8 ++++----
 3 files changed, 13 insertions(+), 13 deletions(-)
 rename helm/{values-dev2.yaml => values-dev4.yaml} (67%)
 rename helm/{values-dev3.yaml => values-dev5.yaml} (67%)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index e740e327963a1..3d450c8aa80e4 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -24,17 +24,17 @@ on:
         type: boolean
         default: false
       target_env:
-        description: "Deploy environment (dev/dev2/dev3/main-prod)"
+        description: "Deploy environment (dev/dev4/dev5/main-prod)"
         required: false
         default: "dev"
         type: choice
         options:
           - dev
-          - dev2
-          - dev3
+          - dev4
+          - dev5
           - main-prod
       branch:
-        description: "Branch to deploy (for dev/dev2/dev3)"
+        description: "Branch to deploy (for dev/dev4/dev5)"
         required: false
         default: "main-prod"
 
@@ -192,7 +192,7 @@ jobs:
             --debug
 
   deploy-dev:
-    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev' || github.event.inputs.target_env == 'dev2' || github.event.inputs.target_env == 'dev3'))
+    if: (github.event_name == 'push' && github.ref == 'refs/heads/main-prod') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_prod == 'false' && (github.event.inputs.target_env == 'dev' || github.event.inputs.target_env == 'dev4' || github.event.inputs.target_env == 'dev5'))
     needs: [build, helm4-compat]
     runs-on: ubuntu-latest
     environment: dev
diff --git a/helm/values-dev2.yaml b/helm/values-dev4.yaml
similarity index 67%
rename from helm/values-dev2.yaml
rename to helm/values-dev4.yaml
index 38e4591faa33b..2e1dc4eaefc34 100644
--- a/helm/values-dev2.yaml
+++ b/helm/values-dev4.yaml
@@ -7,7 +7,7 @@ service-template:
     name: "testzeus-traceviewer-sa"
     automount: false  # nginx does not call the K8s API
     annotations:
-      iam.gke.io/gcp-service-account: "gke-runtime-dev2@dev2-testzeus.iam.gserviceaccount.com"
+      iam.gke.io/gcp-service-account: "gke-runtime-dev@dev-testzeus.iam.gserviceaccount.com"
 
   podSecurityContext:
     seccompProfile:
@@ -16,14 +16,14 @@ service-template:
   containers:
     - name: trace-viewer
       image:
-        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_DEV2/GAR_DOCKER_REPOSITORY_DEV2"
+        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_DEV/GAR_DOCKER_REPOSITORY_DEV"
         tag: latest
         pullPolicy: Always
       ports:
         - containerPort: 80
       env:
         - name: HOST
-          value: "eyJhbGciOiJFUzI1NiIsImtpZCI6IkVsWTBtZyJ9.eyJhdWQiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJleHAiOjQ5MjgzMTM3ODEsImdycGNfYnJvYWRjYXN0X2FkZHJlc3MiOiJoYXRjaGV0LXN0YWNrLWVuZ2luZTo3MDcwIiwiaWF0IjoxNzc0NzEzNzgxLCJpc3MiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJzZXJ2ZXJfdXJsIjoiaHR0cHM6Ly9obC5kZXYudGVzdHpldXMuYXBwIiwic3ViIjoiNzA3ZDA4NTUtODBhYi00ZTFmLWExNTYtZjFjNDU0NmNiZjUyIiwidG9rZW5faWQiOiJkN2VmNzMzNC00MWRmLTQwNTMtOTA3Ny03ZWQ3OWYwNTg4YjAifQ.trW5OLZVZfBQAC_cNiG3AjFLzUzb9bEfTnOQHvPveRn8B--o6_RgWMk2SwFClcoi4k_PloLRyae8hRHBK0OaPg"
+          value: "0.0.0.0"
         - name: PORT
           value: "80"
         - name: NODE_ENV
@@ -64,7 +64,7 @@ service-template:
         namespace: testzeus
         sectionName: https
     hostnames:
-      - "tzviewer.dev2.testzeus.app"
+      - "tzviewer.dev4.testzeus.app"
     rules:
       - matches:
           - path: /
diff --git a/helm/values-dev3.yaml b/helm/values-dev5.yaml
similarity index 67%
rename from helm/values-dev3.yaml
rename to helm/values-dev5.yaml
index e2585572cb09f..e4f215d51791c 100644
--- a/helm/values-dev3.yaml
+++ b/helm/values-dev5.yaml
@@ -7,7 +7,7 @@ service-template:
     name: "testzeus-traceviewer-sa"
     automount: false  # nginx does not call the K8s API
     annotations:
-      iam.gke.io/gcp-service-account: "gke-runtime-dev3@dev3-testzeus.iam.gserviceaccount.com"
+      iam.gke.io/gcp-service-account: "gke-runtime-dev@dev-testzeus.iam.gserviceaccount.com"
 
   podSecurityContext:
     seccompProfile:
@@ -16,14 +16,14 @@ service-template:
   containers:
     - name: trace-viewer
       image:
-        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_DEV3/GAR_DOCKER_REPOSITORY_DEV3"
+        repository: "us-central1-docker.pkg.dev/GCP_PROJECT_ID_DEV/GAR_DOCKER_REPOSITORY_DEV"
         tag: latest
         pullPolicy: Always
       ports:
         - containerPort: 80
       env:
         - name: HOST
-          value: "eyJhbGciOiJFUzI1NiIsImtpZCI6IkVsWTBtZyJ9.eyJhdWQiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJleHAiOjQ5MjgzMTM3ODEsImdycGNfYnJvYWRjYXN0X2FkZHJlc3MiOiJoYXRjaGV0LXN0YWNrLWVuZ2luZTo3MDcwIiwiaWF0IjoxNzc0NzEzNzgxLCJpc3MiOiJodHRwczovL2hsLmRldi50ZXN0emV1cy5hcHAiLCJzZXJ2ZXJfdXJsIjoiaHR0cHM6Ly9obC5kZXYudGVzdHpldXMuYXBwIiwic3ViIjoiNzA3ZDA4NTUtODBhYi00ZTFmLWExNTYtZjFjNDU0NmNiZjUyIiwidG9rZW5faWQiOiJkN2VmNzMzNC00MWRmLTQwNTMtOTA3Ny03ZWQ3OWYwNTg4YjAifQ.trW5OLZVZfBQAC_cNiG3AjFLzUzb9bEfTnOQHvPveRn8B--o6_RgWMk2SwFClcoi4k_PloLRyae8hRHBK0OaPg"
+          value: "0.0.0.0"
         - name: PORT
           value: "80"
         - name: NODE_ENV
@@ -64,7 +64,7 @@ service-template:
         namespace: testzeus
         sectionName: https
     hostnames:
-      - "tzviewer.dev3.testzeus.app"
+      - "tzviewer.dev5.testzeus.app"
     rules:
       - matches:
           - path: /
