[alexandreferris]

---

PR Submission Checklist for internal contributors

• The PR Title

  • conforms to the style of semantic commits messages¹ supported in Wire's Github Workflow²
  • contains a reference JIRA issue number like SQPIT-764
  • answers the question: If merged, this PR will: ... ³

• The PR Description

  • is free of optional paragraphs and you have filled the relevant parts to the best of your ability

---

What's new in this PR?

Issues

Briefly describe the issue you have solved or implemented with this pull request. If the PR contains multiple issues, use a bullet list.

Causes (Optional)

Briefly describe the causes behind the issues. This could be helpful to understand the adopted solutions behind some nasty bugs or complex issues.

Solutions

Briefly describe the solutions you have implemented for the issues explained above.

Dependencies (Optional)

If there are some other pull requests related to this one (e.g. new releases of frameworks), specify them here.

Needs releases with:

• GitHub link to other pull request

Testing

Test Coverage (Optional)

• I have added automated test to this contribution

How to Test

Briefly describe how this change was tested and if applicable the exact steps taken to verify that it works as expected.

Notes (Optional)

Specify here any other facts that you think are important for this issue.

Attachments (Optional)

Attachments like images, videos, etc. (drag and drop in the text box)

---

PR Post Submission Checklist for internal contributors (Optional)

• Wire's Github Workflow has automatically linked the PR to a JIRA issue

---

PR Post Merge Checklist for internal contributors

• If any soft of configuration variable was introduced by this PR, it has been added to the relevant documents and the CI jobs have been updated.

---

References

1. https://sparkbox.com/foundry/semantic_commit_messages
2. https://github.com/wireapp/.github#usage
3. E.g. feat(conversation-list): Sort conversations by most emojis in the title #SQPIT-764.

[claude]

Review: bump PROD image to sha-c277d0f

This is a one-line change to helm/githubapp/values-prod.yaml that moves production from sha-3a9c9d7 to sha-c277d0f. The new commit is c277d0f chore: Update JVM SDK version #WPB-29633 (#162), which is the head of main, and the JIRA ref matches. It looks fine. A few small points:

Code quality / correctness

• ✅ The tag format matches what's already there (sha-<7-char short sha>), and statefulset.yaml uses it as {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}.
• ⚠️ Before merging, check that quay.io/wire/github-app:sha-c277d0f has actually been built and pushed. If the tag is missing, the pod will hit ImagePullBackOff, and with replicaCount: 1 that means downtime.
• Optional: think about bumping version (and appVersion, if you track one) in Chart.yaml along with the image. Then the Helm release history shows that something changed, not only the values.

Risk / testing

• The image being deployed contains a JVM SDK version bump (chore: Update JVM SDK version #WPB-29633 #162). A dependency upgrade like that can change runtime behaviour (serialization, crypto/MLS, client registration). It would help to note in the PR description whether this SHA was checked on staging or locally, for example that the bot connects, receives a webhook and posts to a conversation.
• No automated tests are expected for a values-only change.

Security

• Pinning to an immutable SHA tag instead of latest is good practice. 👍 To go further, you could pin by digest (@sha256:...), which protects against the tag being re-pushed.

PR hygiene

• The description is the empty template. One line such as "Deploys chore: Update JVM SDK version #WPB-29633 #162 (JVM SDK bump) to PROD" plus a rollback note (revert to sha-3a9c9d7) would help whoever deploys or debugs this later.

Approve once the image tag exists in quay. 🚀