deploy(helm): couple migrator image tag to the backend tag

Default migrator.image.tag to backendGraphql.image.tag so the migration
hook always tracks the app release without a separate per-env pin, and
drop the now-redundant tag from the stg/prd overlays. Release does not
auto-bump env values; coupling removes a manual step and its drift risk.

Author: rschlaefli

deploy/charts/klicker-uzh-v3/templates/job-migrate.yaml

@@ -34,7 +34,11 @@ spec:
       {{- end }}
       containers:
         - name: migrate
-          image: "{{ .Values.migrator.image.repository }}:{{ .Values.migrator.image.tag | default .Chart.AppVersion }}"
+          # Tag defaults to the backend-graphql image tag so the migrator always
+          # tracks the app release without a separate per-env pin; falls back to
+          # the chart appVersion. Only the repository is pinned per env (the `-arm`
+          # migrator image differs from the backend image).
+          image: "{{ .Values.migrator.image.repository }}:{{ .Values.migrator.image.tag | default .Values.backendGraphql.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.migrator.image.pullPolicy }}
           # DATABASE_URL comes from the externally-provisioned backend-graphql Secret.
           # Only the Secret is referenced (not the app ConfigMaps): a PreSync hook runs

deploy/env-uzh-prd/values.yaml

@@ -950,8 +950,8 @@ assessment:
       limits:
         memory: 200Mi
 
-# Migration hook image: pin to the SAME tag as backend-docker-arm above.
+# Migration hook image: only the repo is pinned; the tag auto-tracks the
+# backendGraphql image tag above (see chart job-migrate.yaml).
 migrator:
   image:
     repository: ghcr.io/uzh-bf/klicker-uzh/backend-docker-migrator-arm
-    tag: v3.4.0-alpha.62

deploy/env-uzh-stg/values.yaml

@@ -899,8 +899,8 @@ assessment:
         cpu: 200m
         memory: 200Mi
 
-# Migration hook image: tracks the floating v3 tag alongside backend-docker-arm.
+# Migration hook image: only the repo is pinned; the tag auto-tracks the
+# backendGraphql image tag above (floating v3 on stg).
 migrator:
   image:
     repository: ghcr.io/uzh-bf/klicker-uzh/backend-docker-migrator-arm
-    tag: v3

docs/adr/0001-automate-db-migrations-via-argocd-presync-hook.md

@@ -21,6 +21,7 @@ Run `prisma migrate deploy` as an **ArgoCD-native `PreSync` hook Job** (`deploy/
 ## Consequences
 
 - Migrations run while the **previous** app version is still live → every migration must be **backward-compatible (expand-contract)**; destructive/renaming changes are split across releases.
-- The migrator image tag must be bumped in lockstep with the backend tag per release, and its pinned `prisma` version must track `packages/prisma`. Drift → engine/schema mismatch.
+- The migrator image **tag** auto-tracks the backend tag: `job-migrate.yaml` defaults `migrator.image.tag` to `.Values.backendGraphql.image.tag`, so each env pins only the migrator **repository** (`…-migrator-arm`) and never a separate tag. Nothing in the release procedure auto-bumps image tags in `deploy/env-uzh-*/values.yaml` (they are hand-edited), so coupling removes a manual step and the drift it invites.
+- The migrator's pinned `prisma` version must still track the `packages/prisma` devDependency. Drift → engine/schema mismatch.
 - A failed migration blocks the rollout by design; operators must watch the first releases.
 - Adds one image (arm + amd) to build and push per release.

docs/ci-and-deployment.md

@@ -45,7 +45,7 @@ Version bumps are **local and manual** via standard-version: `pnpm run release[:
 
 ## Deployment migrations
 
-`prisma migrate deploy` runs automatically as an ArgoCD **`PreSync` hook Job** (`deploy/charts/klicker-uzh-v3/templates/job-migrate.yaml`) before each stg/prd rollout. It runs a dedicated `backend-docker-migrator` image (`packages/prisma/Dockerfile`), CI-built in lockstep with `backend-docker` (`v3_backend-docker-{stg,prd}.yml`), so the migrator tag always matches the app release tag. A failed hook aborts the whole sync, so app Deployments in the main wave never start against an unmigrated DB. The hook uses **ArgoCD-native** annotations (`argocd.argoproj.io/hook: PreSync`), not Helm chart hooks — the two must not be mixed, because a single ArgoCD hook annotation makes ArgoCD ignore _all_ Helm-native hooks on the chart. Full details: [Data & Migrations → Deployment migrations](./data-and-migrations.md#deployment-migrations). Manual `pnpm --filter @klicker-uzh/prisma prisma:deploy:prod` remains a break-glass fallback only.
+`prisma migrate deploy` runs automatically as an ArgoCD **`PreSync` hook Job** (`deploy/charts/klicker-uzh-v3/templates/job-migrate.yaml`) before each stg/prd rollout. It runs a dedicated `backend-docker-migrator` image (`packages/prisma/Dockerfile`), CI-built in lockstep with `backend-docker` (`v3_backend-docker-{stg,prd}.yml`); its tag auto-tracks the backend tag (the chart defaults `migrator.image.tag` to `backendGraphql.image.tag`), so it always matches the app release with no separate per-env pin. A failed hook aborts the whole sync, so app Deployments in the main wave never start against an unmigrated DB. The hook uses **ArgoCD-native** annotations (`argocd.argoproj.io/hook: PreSync`), not Helm chart hooks — the two must not be mixed, because a single ArgoCD hook annotation makes ArgoCD ignore _all_ Helm-native hooks on the chart. Full details: [Data & Migrations → Deployment migrations](./data-and-migrations.md#deployment-migrations). Manual `pnpm --filter @klicker-uzh/prisma prisma:deploy:prod` remains a break-glass fallback only.
 
 Why this shape (ArgoCD-native hook, dedicated migrator image, manual demoted to break-glass): [ADR-0001](./adr/0001-automate-db-migrations-via-argocd-presync-hook.md).
 

docs/data-and-migrations.md

@@ -35,7 +35,7 @@ The Python twin (`apps/analytics/prisma/schema/py.prisma`) uses `prisma-client-p
 
 `prisma migrate deploy` runs **automatically** on every stg/prd rollout as an ArgoCD **`PreSync` hook Job** (`deploy/charts/klicker-uzh-v3/templates/job-migrate.yaml`), not by hand. Mechanics:
 
-- A dedicated migrator image (`packages/prisma/Dockerfile`: `node:24.16.0-alpine` + global `prisma`, carrying the schema + `migrations/`) runs `prisma migrate deploy`. It exists because the backend runtime image installs `--prod --ignore-scripts` and so ships neither the Prisma CLI nor the migration engine. CI builds it as `backend-docker-migrator{-arm,-amd}` in lockstep with `backend-docker` (`v3_backend-docker-{stg,prd}.yml`); keep the migrator tag equal to the backend tag in `deploy/env-uzh-{stg,prd}/values.yaml`.
+- A dedicated migrator image (`packages/prisma/Dockerfile`: `node:24.16.0-alpine` + global `prisma`, carrying the schema + `migrations/`) runs `prisma migrate deploy`. It exists because the backend runtime image installs `--prod --ignore-scripts` and so ships neither the Prisma CLI nor the migration engine. CI builds it as `backend-docker-migrator{-arm,-amd}` in lockstep with `backend-docker` (`v3_backend-docker-{stg,prd}.yml`). Its image **tag** auto-tracks the backend tag — the chart defaults `migrator.image.tag` to `backendGraphql.image.tag`, so each env pins only the migrator **repository** and never a separate tag.
 - The hook draws `DATABASE_URL` from the externally-provisioned `…-secret-backend-graphql` Secret only (a PreSync hook must not depend on Sync-phase ConfigMaps). Toggle with `migrator.enabled`.
 - A **failed** hook aborts the whole sync — app Deployments never roll onto an unmigrated DB. The Job runs while the **previous** app version is still live, so migrations must be **backward-compatible (expand-contract)**; a destructive/renaming migration must be split across releases.
 - **Break-glass only:** `pnpm --filter @klicker-uzh/prisma prisma:deploy:prod` (Infisical `--env prd`) still applies migrations manually from a workstation. Use it only when the hook is unavailable; `prisma:resolve:prod` resolves a failed/partial migration.