feat: Add CI/CD and documentation polish (Phase 4)

[Alan-Cha]

Summary

Phase 4 (FINAL) of the Vault pattern: CI/CD integration and documentation polish.

Stacked on: #381 (Phase 3 - Webhook integration)

This PR completes the Vault pattern implementation by adding CI/CD automation and comprehensive workflow documentation.

What This Adds

CI/CD Integration

• Added vault-fetcher to build matrix in .github/workflows/build.yaml
• Will automatically build and push ghcr.io/kagenti/kagenti-extensions/vault-fetcher on releases

Documentation Updates

• Updated CLAUDE.md — Added vault-fetcher to container images table
• Created STACKED_PR_WORKFLOW.md (300+ lines) — Comprehensive stacked PR guide

STACKED_PR_WORKFLOW.md — Critical Documentation

This new document is essential for maintaining the stacked PR workflow, especially when earlier PRs receive review feedback.

Key sections:

1. Understanding stacked PRs — What they are, benefits
2. Creating stacked PRs — Manual and gh-stack methods
3. ⚠️ THE CRITICAL REBASE PROCESS — How to cascade rebase when earlier branches change
4. Handling conflicts — Step-by-step conflict resolution
5. Merging strategy — Order and base branch updates
6. Common scenarios — Adding/removing branches, cherry-picking fixes
7. Best practices — Force-with-lease, testing, communication

Why This Matters

Example scenario covered:

• Reviewer requests changes to Phase 1 (authlib/vault)
• You update feat/vault-integration branch
• ALL SUBSEQUENT BRANCHES MUST BE REBASED (Phase 2, 3, 4)
• Document shows exact commands and process

Rebase cascade commands:
```bash
git checkout feat/vault-fetcher-cli && git rebase feat/vault-integration && git push --force-with-lease
git checkout feat/vault-webhook && git rebase feat/vault-fetcher-cli && git push --force-with-lease
git checkout feat/vault-docs-polish && git rebase feat/vault-webhook && git push --force-with-lease
```

Files Modified

• .github/workflows/build.yaml — Add vault-fetcher to matrix
• CLAUDE.md — Document vault-fetcher image

Files Added

• STACKED_PR_WORKFLOW.md (300+ lines) — Complete stacked PR guide

Total: ~454 lines added

Stacked PR Structure (FINAL)

```
main
└─> #379 (Phase 1: authlib/vault library)
└─> #380 (Phase 2: vault-fetcher CLI)
└─> #381 (Phase 3: Webhook integration)
└─> THIS PR (Phase 4: CI/CD & docs) ← FINAL
```

Completion Status

✅ Phase 1: authlib/vault library
✅ Phase 2: vault-fetcher CLI tool
✅ Phase 3: Webhook integration docs
✅ Phase 4: CI/CD + workflow docs

🎉 Vault pattern implementation is COMPLETE with this PR!

Merge Strategy

After all reviews are complete:

1. Merge feat: Add Vault integration library to authlib #379 (Phase 1) into main
2. GitHub will offer to update feat: Add vault-fetcher CLI tool (Phase 2) #380's base to main (or use gh pr edit 380 --base main)
3. Merge feat: Add vault-fetcher CLI tool (Phase 2) #380 (Phase 2) into main
4. Update feat: Add webhook integration guide (Phase 3) #381's base to main
5. Merge feat: Add webhook integration guide (Phase 3) #381 (Phase 3) into main
6. Update feat: Add CI/CD and documentation polish (Phase 4) #382's (this PR) base to main
7. Merge feat: Add CI/CD and documentation polish (Phase 4) #382 (Phase 4) into main

Or: Squash Phases 2-4 together and merge as one final PR after Phase 1 merges.

Review Notes

Focus review on:

1. CI/CD config: Is the build matrix entry correct?
2. Documentation accuracy: Does STACKED_PR_WORKFLOW.md cover all scenarios?
3. Completeness: Any missing documentation?

Testing

After merge, vault-fetcher will build on next tag push:
```bash
git tag v0.2.0
git push origin v0.2.0

Triggers build.yaml workflow

Pushes ghcr.io/kagenti/kagenti-extensions/vault-fetcher:v0.2.0

```

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. If this PR is still relevant, please comment or remove the stale label.

[mrsabath]

We are putting Vault activity on hold until we figure out whether this work should be done by CPEX or directly in Cortex.