feat: archive build/deploy logs to MinIO for post-eviction retrieval

[vigneshrajsb]

Problem

Build and deploy job logs are permanently lost once k8s Job pods are evicted or TTL-expired (~24h):

• Job history is fetched entirely from live k8s (getNativeBuildJobs, getDeploymentJobs)
• Logs are streamed from live pods via WebSocket
• When pods disappear the UI renders a broken `NotFound` state with no recovery path

Solution

Add MinIO as an optional in-cluster S3-compatible object store. Logs are archived at job completion time and served back transparently — the UI sees a new `Archived` status instead of `NotFound`.

Architecture

```
Job completes → archive logs.txt + metadata.json to MinIO
└── {namespace}/{jobType}/{serviceName}/{jobName}/

Pod evicted after TTL...

UI requests log stream info → backend returns status='Archived' + archivedLogs text
UI requests job list → archived jobs merged into live k8s results (deduplicated by jobName)
```

Changes

New files

File	Purpose
`src/server/lib/objectStore/s3Client.ts`	S3Client singleton supporting MinIO (forcePathStyle + explicit creds) and AWS S3 (IRSA)
`src/server/services/logArchival.ts`	LogArchivalService: archiveLogs, getArchivedLogs, listArchivedJobs, ensureBucket
`src/server/services/types/logArchival.ts`	ArchivedJobMetadata interface

Modified files (lifecycle backend)

File	Change
`src/shared/config.ts`	Export `OBJECT_STORE_*` env vars with safe defaults
`next.config.js`	Add `OBJECT_STORE_*` vars to serverRuntimeConfig; add `@aws-sdk/client-s3` to serverComponentsExternalPackages
`src/server/services/types/globalConfig.ts`	Add `logArchival?: { enabled: boolean }`
`src/server/services/types/logStreaming.ts`	Add `'Archived'` status; add `archivedLogs?` field
`src/server/lib/nativeBuild/engines.ts`	Archive build logs after job completes (success + failure paths)
`src/server/lib/nativeHelm/helm.ts`	Archive deploy logs after job completes
`src/server/lib/kubernetes/getNativeBuildJobs.ts`	Merge archived build jobs; upgrade live jobs with missing pods to `source='archived'`; add `source` field to `BuildJobInfo`
`src/server/lib/kubernetes/getDeploymentJobs.ts`	Same pattern for deploy jobs; add `source` field to `DeploymentJobInfo`
`src/server/services/logStreaming.ts`	Fall back to archived log lookup when k8s returns NotFound
`src/shared/openApiSpec.ts`	Add `'Archived'` status, `archivedLogs` field, `source` field to all relevant schemas
`src/server/db/migrations/001_seed.ts`	Seed `logArchival` config row (disabled by default)
`src/pages/api/v1/.../buildLogs.ts`	Add `podName`, `error`, `source` fields to inline OpenAPI schema
`src/pages/api/v1/.../deployLogs.ts`	Add `Pending` to status enum, add `source` field to inline OpenAPI schema
`src/pages/api/v1/.../logs/[jobName].ts`	Add `'Archived'` status and `archivedLogs` to inline OpenAPI schema
`helm/environments/local/lifecycle.yaml`	Add `OBJECT_STORE_*` env vars for local dev MinIO
`Tiltfile`	Deploy MinIO via `helm_resource` for local dev

Related PRs

• helm-charts (released v0.8.0): feat(lifecycle): add MinIO subchart with secure credential architecture for log archival (v0.8.0) helm-charts#32 — MinIO subchart, objectStore secret, deployments envFrom wiring
• lifecycle-ui: https://github.com/GoodRxOSS/lifecycle-ui/pull/28 — UI archived log rendering

Key design decisions

Feature-gated: all object store calls check `globalConfig.logArchival?.enabled`. Seeded as `false` — enabling requires an explicit DB update. Deploying the infra (MinIO pod) is safe before enabling the flag.

Non-blocking: archival failures are caught and logged as warnings — they never fail the build/deploy flow.

Deduplication: merged archived jobs are deduplicated by `jobName` against live k8s results, so a completing job never appears twice.

S3 support: set `OBJECT_STORE_TYPE=s3` to use AWS S3 with IRSA — no credentials in config. Bucket must be pre-provisioned.

Enabling

1. Deploy MinIO via helm-charts (v0.8.0+) with `minio.enabled=true` and `secrets.objectStore.enabled=true`
2. Insert into `global_config`:
   ```json
   { "logArchival": { "enabled": true } }
   ```

Test plan

• `pnpm lint` passes ✅
• `pnpm ts-check` — no new errors (pre-existing errors in scripts/ and engines.ts unrelated to this PR) ✅
• `pnpm test` — 951/951 pass ✅
• With `logArchival.enabled=false` (default): system behavior identical to before, no object store calls
• With `logArchival.enabled=true`: trigger a build, verify `logs.txt` + `metadata.json` appear in MinIO bucket
• Delete the job pod manually, verify it still appears in the build job list with `source='archived'`
• Click the archived job in the UI — logs render via `staticContent` (not WebSocket)

🤖 Generated with Claude Code