From d0788f0a5239c37013b86b7d25e45e0ef9013956 Mon Sep 17 00:00:00 2001
From: William Valentin <william.valentin.info@gmail.com>
Date: Thu, 5 Feb 2026 11:59:54 -0800
Subject: [PATCH] fix: guard lifecycle prefixes

---
 helm/porthole/templates/job-apply-lifecycle.yaml.tpl | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/helm/porthole/templates/job-apply-lifecycle.yaml.tpl b/helm/porthole/templates/job-apply-lifecycle.yaml.tpl
index d755b8a..3a91131 100644
--- a/helm/porthole/templates/job-apply-lifecycle.yaml.tpl
+++ b/helm/porthole/templates/job-apply-lifecycle.yaml.tpl
@@ -1,4 +1,10 @@
 {{- if and .Values.jobs.applyLifecycle.enabled .Values.minio.enabled -}}
+{{- if or (eq .Values.jobs.applyLifecycle.prefixes.thumbs "") (eq .Values.jobs.applyLifecycle.prefixes.derived "") -}}
+{{- fail "applyLifecycle prefixes must be non-empty" -}}
+{{- end -}}
+{{- if or (eq .Values.jobs.applyLifecycle.prefixes.thumbs "originals/") (eq .Values.jobs.applyLifecycle.prefixes.derived "originals/") -}}
+{{- fail "applyLifecycle prefixes must not target originals/" -}}
+{{- end -}}
 apiVersion: batch/v1
 kind: Job
 metadata: