format log level, annotate pod, rollout deployment

.github/workflows/_deploy.yml

@@ -27,17 +27,10 @@ jobs:
     environment: production
 
     steps:
-      - name: Upgrade helm chart
-        id: deploy
-        run: |
-          helm repo add huisheng https://huisheng.charts.axatol.xyz
-          helm repo update
-          helm upgrade huisheng huisheng/huisheng \
-            --install \
-            --create-namespace \
-            --namespace huisheng \
-            --atomic \
-            --reuse-values
+      - uses: axatol/actions/rollout-kubernetes-deployment@release
+        with:
+          namespace: huisheng
+          deployment-name: huisheng
 
       - name: Create deployment marker
         if: success()

charts/huisheng/templates/deployment.yaml

@@ -16,6 +16,9 @@ spec:
       labels: {{ include "huisheng.selectorLabels" . | nindent 8 }}
       annotations:
         credentials/checksum: {{ include (print $.Template.BasePath "/credentials.yaml") . | sha256sum }}
+        {{- range $key, $value := range .Values.podAnnotations }}
+        {{ $key }}: {{ $value | quote }}
+        {{- end }}
     spec:
       containers:
         - name: huisheng
@@ -32,7 +35,13 @@ spec:
               value: {{ $value | toString | quote }}
             {{- end }}
           securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 10000
+            runAsGroup: 10000
+            readOnlyRootFilesystem: true
             capabilities:
+              drop: [ALL]
               add: [SYS_NICE]
           volumeMounts:
             - name: data

charts/huisheng/values.yaml

@@ -1,6 +1,8 @@
 image: public.ecr.aws/axatol/huisheng:latest
 imagePullPolicy: Always
 
+podAnnotations: {}
+
 env:
   {}
   # DEBUG:

src/config.ts

@@ -74,6 +74,9 @@ export const log = pino({
   transport:
     config.logFormat == 'text' ? { target: 'pino-pretty', options: { colorize: true } } : undefined,
   level: config.logLevel,
+  formatters: {
+    level: (label, _number) => ({ level: label }),
+  },
   serializers: {
     error: (error: any): any => {
       if (