feat(helm): derive chart appVersion from the release instead of gating on it

appVersion is what the chart's image tags default to, so a stale one publishes
a chart that installs an older Sim than the release it ships with, and
images.yaml -- the list an operator mirrors into a disconnected registry --
names the wrong tags with it. Published chart versions are immutable, so each
stale value is frozen the moment it ships.

It was bumped by hand, drifted forty releases, and drifted twice more after a
check started catching it. That is the tell: the check could refuse to publish
but could not supply the value, so the only thing it reliably produced was a
red build on every release and a chart that never shipped. Only 1.11.0 was
ever published for exactly this reason.

The publish jobs now derive it. On a release merge the tag does not exist yet
-- this commit is what cuts it -- so the version comes from the commit
subject, and from the latest release for every other push. Both publish paths
run the same script before packaging, so the OCI artifact and the HTTP repo
cannot disagree.

Removes the post-merge check, which is now unreachable by construction, and
does not replace it with the pre-merge title gate that was considered: that
one guarded ground truth with a heuristic, and its failure mode was passing
silently.

Precedent is cert-manager, whose chart also lives in its application repo and
which injects the version at package time. The projects that commit the value
and bump by hand -- argo-cd, ingress-nginx, prometheus-community -- all keep
the chart in a separate repository, where a human is already editing
Chart.yaml as the unit of change. We are the former shape.

Verified the resolution across six subjects: release commit, multi-line body
carrying a decoy version, ordinary push, leading whitespace, shell
metacharacters (no expansion), and a version that is not at the start. Also
verified the script's exit codes directly rather than through a pipe, since a
gate that cannot fail is the thing being replaced here.

Sets appVersion to v0.8.26, two releases ahead of where it was stuck, and
regenerates images.yaml with it.

Author: waleedlatif1

.github/workflows/helm.yml

@@ -232,6 +232,44 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.1
+
+      # The release this chart ships with. On a release merge the tag does not
+      # exist yet -- it is cut by this very commit (detect-version in ci.yml) --
+      # so the subject is the only source available, and the source of truth for
+      # every other push is the latest release.
+      - name: Resolve the app release
+        id: release
+        env:
+          HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          subject=${HEAD_COMMIT_MESSAGE%%$'\n'*}
+          if [[ "$subject" =~ ^[[:space:]]*(v[0-9]+\.[0-9]+\.[0-9]+): ]]; then
+            resolved="${BASH_REMATCH[1]}"
+            echo "Release commit; shipping the chart with ${resolved}."
+          else
+            resolved=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)
+            echo "Not a release commit; shipping the chart with the latest release ${resolved}."
+          fi
+          if [ -z "$resolved" ]; then
+            echo "::error::Could not resolve an app release to ship this chart with."
+            exit 1
+          fi
+          echo "version=${resolved}" >> "$GITHUB_OUTPUT"
+
+      # Derives appVersion rather than checking it, so the published chart cannot
+      # be pinned to an older Sim than the release it ships with. The committed
+      # value is kept current too, but nothing depends on a human remembering.
+      - name: Sync chart appVersion to the release
+        env:
+          APP_VERSION: ${{ steps.release.outputs.version }}
+        run: bun run scripts/sync-chart-appversion.ts --version "${APP_VERSION}"
+
       - name: Package chart
         id: package
         run: |
@@ -247,44 +285,6 @@ jobs:
             echo "repository=ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts/${name}"
           } >> "$GITHUB_OUTPUT"
 
-      # `appVersion` is what the image tags default to, so a stale one publishes
-      # a chart that silently installs an old Sim -- and because published chart
-      # versions are immutable, every stale value is frozen forever. It sat six
-      # releases behind before this check existed, bumped only by hand.
-      #
-      # BEHIND is the failure. AHEAD is normal and must not be blocked: a
-      # version tag is cut by the main-branch merge commit that releases it
-      # (detect-version in ci.yml), so appVersion legitimately names a release
-      # that does not exist yet while that release is still being built. Failing
-      # on any mismatch would race that workflow and block the very publish the
-      # bump was for. `helm/sim/ci/kind-overlay.yaml` documents the same
-      # circularity, and it is why appVersion went unbumped for so long.
-      #
-      # Compares against the latest GitHub release rather than a hardcoded value
-      # so the check cannot go stale itself. Prereleases and drafts are excluded:
-      # the `/releases/latest` endpoint already returns neither.
-      - name: appVersion does not lag the app release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          app_version=$(helm show chart helm/sim | awk '/^appVersion:/ {print $2}' | tr -d '"')
-          latest=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)
-          if [ -z "$latest" ]; then
-            echo "::error::Could not resolve the latest release; refusing to publish unverified."
-            exit 1
-          fi
-          if [ "$app_version" = "$latest" ]; then
-            echo "appVersion ${app_version} matches the latest release."
-            exit 0
-          fi
-          oldest=$(printf '%s\n%s\n' "$app_version" "$latest" | sort -V | head -1)
-          if [ "$oldest" = "$app_version" ]; then
-            echo "::error::Chart.yaml appVersion is ${app_version} but the latest release is ${latest}. Bump appVersion (and the chart version) so the chart does not publish an install pinned to an older Sim."
-            exit 1
-          fi
-          echo "::notice::appVersion ${app_version} is ahead of the latest release ${latest}, which is expected while that release is still being cut."
-
       # Chart versions are immutable once published: whoever pinned a version
       # must keep resolving the same bytes forever. The PR gate above already
       # forces a version bump on every chart change, so a version that is
@@ -452,6 +452,46 @@ jobs:
             echo "::warning::No gh-pages branch, so the HTTP chart repo was not updated. Create it and point GitHub Pages at it to activate this job. The OCI publish is unaffected."
           fi
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.1
+
+      # The release this chart ships with. On a release merge the tag does not
+      # exist yet -- it is cut by this very commit (detect-version in ci.yml) --
+      # so the subject is the only source available, and the source of truth for
+      # every other push is the latest release.
+      - name: Resolve the app release
+        if: steps.pages.outputs.exists == 'true'
+        id: release
+        env:
+          HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          subject=${HEAD_COMMIT_MESSAGE%%$'\n'*}
+          if [[ "$subject" =~ ^[[:space:]]*(v[0-9]+\.[0-9]+\.[0-9]+): ]]; then
+            resolved="${BASH_REMATCH[1]}"
+            echo "Release commit; shipping the chart with ${resolved}."
+          else
+            resolved=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)
+            echo "Not a release commit; shipping the chart with the latest release ${resolved}."
+          fi
+          if [ -z "$resolved" ]; then
+            echo "::error::Could not resolve an app release to ship this chart with."
+            exit 1
+          fi
+          echo "version=${resolved}" >> "$GITHUB_OUTPUT"
+
+      # Derives appVersion rather than checking it, so the published chart cannot
+      # be pinned to an older Sim than the release it ships with. The committed
+      # value is kept current too, but nothing depends on a human remembering.
+      - name: Sync chart appVersion to the release
+        if: steps.pages.outputs.exists == 'true'
+        env:
+          APP_VERSION: ${{ steps.release.outputs.version }}
+        run: bun run scripts/sync-chart-appversion.ts --version "${APP_VERSION}"
+
       - name: Configure Git
         if: steps.pages.outputs.exists == 'true'
         env:

helm/sim/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.11.1
-appVersion: "v0.8.24"
+version: 1.11.2
+appVersion: "v0.8.26"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai
 icon: https://raw.githubusercontent.com/simstudioai/sim/main/apps/sim/public/logo/primary/primary.svg

helm/sim/images.yaml

@@ -22,22 +22,22 @@
 # render it twice. That override also CHANGES where the chart pulls from, to
 # `<your-registry>/nvidia/k8s-device-plugin` — mirror the device plugin there
 # instead of to the `mirror` path listed below, or the pull fails.
-appVersion: v0.8.24
+appVersion: v0.8.26
 images:
   - source: busybox:1.36
     mirror: busybox:1.36
   - source: curlimages/curl:8.5.0
     mirror: curlimages/curl:8.5.0
-  - source: ghcr.io/simstudioai/copilot:v0.8.24
-    mirror: simstudioai/copilot:v0.8.24
-  - source: ghcr.io/simstudioai/migrations:v0.8.24
-    mirror: simstudioai/migrations:v0.8.24
-  - source: ghcr.io/simstudioai/pii:v0.8.24
-    mirror: simstudioai/pii:v0.8.24
-  - source: ghcr.io/simstudioai/realtime:v0.8.24
-    mirror: simstudioai/realtime:v0.8.24
-  - source: ghcr.io/simstudioai/simstudio:v0.8.24
-    mirror: simstudioai/simstudio:v0.8.24
+  - source: ghcr.io/simstudioai/copilot:v0.8.26
+    mirror: simstudioai/copilot:v0.8.26
+  - source: ghcr.io/simstudioai/migrations:v0.8.26
+    mirror: simstudioai/migrations:v0.8.26
+  - source: ghcr.io/simstudioai/pii:v0.8.26
+    mirror: simstudioai/pii:v0.8.26
+  - source: ghcr.io/simstudioai/realtime:v0.8.26
+    mirror: simstudioai/realtime:v0.8.26
+  - source: ghcr.io/simstudioai/simstudio:v0.8.26
+    mirror: simstudioai/simstudio:v0.8.26
   - source: nvcr.io/nvidia/k8s-device-plugin:v0.18.2
     mirror: nvcr.io/nvidia/k8s-device-plugin:v0.18.2
   - source: ollama/ollama:0.23.2

scripts/sync-chart-appversion.ts

@@ -0,0 +1,95 @@
+#!/usr/bin/env bun
+/**
+ * Writes the application release a chart ships with into `helm/sim/Chart.yaml`
+ * and regenerates the image inventory that derives from it.
+ *
+ * `appVersion` is what the chart's image tags default to, so a stale one
+ * publishes a chart that silently installs an older Sim, and `helm/sim/images.yaml`
+ * — the list an operator mirrors into a disconnected registry — names the wrong
+ * tags with it. Because published chart versions are immutable, a stale value is
+ * frozen the moment it ships.
+ *
+ * It was bumped by hand and drifted for forty releases, then twice more after a
+ * check started catching it. The check could only refuse to publish; it could not
+ * supply the value. The publish jobs run this instead, so the number is derived
+ * from the release rather than remembered.
+ *
+ * Only node builtins are imported so this runs on a CI job with no dependencies
+ * installed, matching `generate-image-manifest.ts`.
+ *
+ * @example
+ * ```
+ * bun run scripts/sync-chart-appversion.ts --version v0.8.26
+ * bun run scripts/sync-chart-appversion.ts --version v0.8.26 --check
+ * ```
+ */
+import { spawnSync } from 'node:child_process'
+import { readFile, writeFile } from 'node:fs/promises'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const CHART_PATH = resolve(ROOT, 'helm/sim/Chart.yaml')
+
+/** A release tag as this repository cuts them: `v1.2.3`. */
+const RELEASE_TAG = /^v\d+\.\d+\.\d+$/
+
+/** Matches the top-level `appVersion:` key, quoted or bare. */
+const APP_VERSION_LINE = /^appVersion:.*$/m
+
+function parseArgs(argv: string[]): { version: string; check: boolean } {
+  const versionIndex = argv.indexOf('--version')
+  const version = versionIndex === -1 ? '' : (argv[versionIndex + 1] ?? '')
+  if (!RELEASE_TAG.test(version)) {
+    throw new Error(
+      `--version must be a release tag like v1.2.3, got ${version ? `"${version}"` : '<missing>'}`
+    )
+  }
+  return { version, check: argv.includes('--check') }
+}
+
+async function main() {
+  const { version, check } = parseArgs(process.argv.slice(2))
+
+  const chart = await readFile(CHART_PATH, 'utf8')
+  if (!APP_VERSION_LINE.test(chart)) {
+    throw new Error(`No top-level appVersion key in ${CHART_PATH}`)
+  }
+
+  const next = chart.replace(APP_VERSION_LINE, `appVersion: "${version}"`)
+  const changed = next !== chart
+
+  if (check) {
+    if (changed) {
+      console.error(
+        `helm/sim/Chart.yaml appVersion does not match ${version}. Run:\n` +
+          `  bun run scripts/sync-chart-appversion.ts --version ${version}`
+      )
+      process.exit(1)
+    }
+    console.log(`appVersion is already ${version}.`)
+    return
+  }
+
+  if (changed) {
+    await writeFile(CHART_PATH, next)
+    console.log(`Set appVersion to ${version}.`)
+  } else {
+    console.log(`appVersion was already ${version}.`)
+  }
+
+  /**
+   * The inventory embeds appVersion in every first-party image tag, so it has to
+   * follow. Spawned rather than imported because the generator writes on import
+   * of its own main and owns its formatting.
+   */
+  const generated = spawnSync('bun', ['run', 'scripts/generate-image-manifest.ts'], {
+    cwd: ROOT,
+    stdio: 'inherit',
+  })
+  if (generated.status !== 0) {
+    throw new Error(`generate-image-manifest.ts exited with ${generated.status}`)
+  }
+}
+
+if (import.meta.main) await main()