fix(helm): match ci.yml's release predicate and resolve the version once

Two review findings, both real.

The leading-whitespace tolerance was wrong here. detect-version in ci.yml is
what actually cuts the tag and builds the images, and it anchors the version
at the first character. Accepting a subject it rejects meant the chart could
publish naming a release that was never created, pointing at images that do
not exist. The pattern is now identical to ci.yml's, with a comment saying it
has to stay that way. The tolerance came from a PR-title parsing problem in an
earlier design; commit subjects have a different authority.

The two publish jobs also resolved the version independently, and they run in
parallel. A release becoming public between those two API calls would package
the same immutable chart version with different appVersions, so the OCI
artifact and the HTTP repo would install different Sims. Resolution moved to
one job both consume, which also removes the duplicated logic.

Separately, --check only inspected Chart.yaml while the script writes both
that and the inventory derived from it, so it could report success over a
stale inventory. It now verifies both halves; confirmed it exits 1 when the
inventory is stale and 0 once regenerated.

Author: waleedlatif1

.github/workflows/helm.yml

@@ -193,6 +193,49 @@ jobs:
       - name: Run helm test
         run: helm test sim --namespace sim --timeout 5m
 
+  # Resolved once and shared, so the two publish paths cannot package the same
+  # immutable chart version with different appVersions -- they run in parallel,
+  # and a release becoming public between two independent API calls would be
+  # enough to make the OCI artifact and the HTTP repo install different Sims.
+  release-version:
+    name: Resolve the app release
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 5
+    permissions:
+      contents: read # Read the release list.
+    outputs:
+      version: ${{ steps.resolve.outputs.version }}
+    steps:
+      # On a release merge the tag does not exist yet -- this commit is what cuts
+      # it -- so the subject is the only source available, and the latest release
+      # is the source of truth for every other push.
+      #
+      # The subject pattern MUST stay identical to detect-version in ci.yml, which
+      # is what actually creates the tag and builds the images. If this one
+      # matched a subject that one rejects, the chart would publish naming a
+      # release that was never cut.
+      - name: Resolve the app release
+        id: resolve
+        env:
+          HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          subject=${HEAD_COMMIT_MESSAGE%%$'\n'*}
+          if [[ "$subject" =~ ^(v[0-9]+\.[0-9]+\.[0-9]+): ]]; then
+            resolved="${BASH_REMATCH[1]}"
+            echo "Release commit; shipping the chart with ${resolved}."
+          else
+            resolved=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)
+            echo "Not a release commit; shipping the chart with the latest release ${resolved}."
+          fi
+          if [ -z "$resolved" ]; then
+            echo "::error::Could not resolve an app release to ship this chart with."
+            exit 1
+          fi
+          echo "version=${resolved}" >> "$GITHUB_OUTPUT"
+
   # Publishes the chart to GHCR as an OCI artifact. Self-hosters cannot admit a
   # chart pulled from a git checkout — they need an immutable, versioned artifact
   # they can pin by digest and mirror into an internal registry — so shipping the
@@ -204,7 +247,7 @@ jobs:
   # A separate workflow would race those instead of waiting for them.
   publish:
     name: Publish chart to GHCR
-    needs: [chart, install]
+    needs: [chart, install, release-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
@@ -237,37 +280,12 @@ jobs:
         with:
           bun-version: 1.4.1
 
-      # The release this chart ships with. On a release merge the tag does not
-      # exist yet -- it is cut by this very commit (detect-version in ci.yml) --
-      # so the subject is the only source available, and the source of truth for
-      # every other push is the latest release.
-      - name: Resolve the app release
-        id: release
-        env:
-          HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          subject=${HEAD_COMMIT_MESSAGE%%$'\n'*}
-          if [[ "$subject" =~ ^[[:space:]]*(v[0-9]+\.[0-9]+\.[0-9]+): ]]; then
-            resolved="${BASH_REMATCH[1]}"
-            echo "Release commit; shipping the chart with ${resolved}."
-          else
-            resolved=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)
-            echo "Not a release commit; shipping the chart with the latest release ${resolved}."
-          fi
-          if [ -z "$resolved" ]; then
-            echo "::error::Could not resolve an app release to ship this chart with."
-            exit 1
-          fi
-          echo "version=${resolved}" >> "$GITHUB_OUTPUT"
-
       # Derives appVersion rather than checking it, so the published chart cannot
       # be pinned to an older Sim than the release it ships with. The committed
       # value is kept current too, but nothing depends on a human remembering.
       - name: Sync chart appVersion to the release
         env:
-          APP_VERSION: ${{ steps.release.outputs.version }}
+          APP_VERSION: ${{ needs.release-version.outputs.version }}
         run: bun run scripts/sync-chart-appversion.ts --version "${APP_VERSION}"
 
       - name: Package chart
@@ -422,7 +440,7 @@ jobs:
   # the job holding the signing identity.
   publish-http:
     name: Publish chart to the Helm repo
-    needs: [chart, install]
+    needs: [chart, install, release-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
@@ -457,39 +475,13 @@ jobs:
         with:
           bun-version: 1.4.1
 
-      # The release this chart ships with. On a release merge the tag does not
-      # exist yet -- it is cut by this very commit (detect-version in ci.yml) --
-      # so the subject is the only source available, and the source of truth for
-      # every other push is the latest release.
-      - name: Resolve the app release
-        if: steps.pages.outputs.exists == 'true'
-        id: release
-        env:
-          HEAD_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          subject=${HEAD_COMMIT_MESSAGE%%$'\n'*}
-          if [[ "$subject" =~ ^[[:space:]]*(v[0-9]+\.[0-9]+\.[0-9]+): ]]; then
-            resolved="${BASH_REMATCH[1]}"
-            echo "Release commit; shipping the chart with ${resolved}."
-          else
-            resolved=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)
-            echo "Not a release commit; shipping the chart with the latest release ${resolved}."
-          fi
-          if [ -z "$resolved" ]; then
-            echo "::error::Could not resolve an app release to ship this chart with."
-            exit 1
-          fi
-          echo "version=${resolved}" >> "$GITHUB_OUTPUT"
-
       # Derives appVersion rather than checking it, so the published chart cannot
       # be pinned to an older Sim than the release it ships with. The committed
       # value is kept current too, but nothing depends on a human remembering.
       - name: Sync chart appVersion to the release
         if: steps.pages.outputs.exists == 'true'
         env:
-          APP_VERSION: ${{ steps.release.outputs.version }}
+          APP_VERSION: ${{ needs.release-version.outputs.version }}
         run: bun run scripts/sync-chart-appversion.ts --version "${APP_VERSION}"
 
       - name: Configure Git

scripts/sync-chart-appversion.ts

@@ -22,6 +22,9 @@
  * bun run scripts/sync-chart-appversion.ts --version v0.8.26
  * bun run scripts/sync-chart-appversion.ts --version v0.8.26 --check
  * ```
+ *
+ * `--check` verifies both halves: that Chart.yaml names the version and that the
+ * inventory generated from it is current.
  */
 import { spawnSync } from 'node:child_process'
 import { readFile, writeFile } from 'node:fs/promises'
@@ -67,7 +70,17 @@ async function main() {
       )
       process.exit(1)
     }
-    console.log(`appVersion is already ${version}.`)
+    /**
+     * The inventory derives from appVersion, so a matching Chart.yaml alone does
+     * not mean the pair is consistent -- checking only half of what this script
+     * writes would report success over a stale inventory.
+     */
+    const verified = spawnSync('bun', ['run', 'scripts/generate-image-manifest.ts', '--check'], {
+      cwd: ROOT,
+      stdio: 'inherit',
+    })
+    if (verified.status !== 0) process.exit(verified.status ?? 1)
+    console.log(`appVersion is ${version} and the image inventory matches.`)
     return
   }