release: client chart 1.6.1 — proxy-key exclusion gate (#238) + appVersion lockstep

[saadqbal]

Cuts client chart 1.6.1 as a fast-follow to the (still-unpublished) 1.6.0, bundling two release-hygiene fixes plus the version bump. All verified on develop: 196 helm-unittest pass, lint + 4-platform render (aks/bm/eks/oc) clean.

Chart: version 1.6.0 → 1.6.1, appVersion 1.5.1 → 1.6.1 (kept in lockstep).

---

1. Closes #238 — gate proxy-key exclusion on HTTP_PROXY_HOST

Refines #236 (already on develop), flagged by Cursor Bugbot on release PR #235.

Problem (upgrade regression): #236 excluded the proxy-owned keys (HTTP_PROXY/HTTPS_PROXY/NO_PROXY/… + the HTTP_PROXY_* inputs) from jobs-manager's generic .Values.env passthrough unconditionally, intending tracebloc.proxyEnv to be the sole source. But proxyEnv only emits when HTTP_PROXY_HOST is set (_helpers.tpl:215). When it's unset, proxyEnv renders nothing and the passthrough now drops a directly-set env.HTTP_PROXY (a full proxy URL — the pre-1.6.0 way to configure a corporate proxy). Clusters that used the raw HTTP_PROXY value instead of HTTP_PROXY_HOST lose backend/registry egress on upgrade.

Fix: build $proxyKeys empty and only populate it when .Values.env.HTTP_PROXY_HOST is set (mirrors proxyEnv's own gate). The passthrough loops already key off $proxyKeys:

• host unset → list empty → passthrough emits directly-set proxy vars verbatim (prior behavior preserved).
• host set → list populated → exclusion holds exactly as in fix(#229): jobs-manager re-emits NO_PROXY unmerged for proxy customers #236 (proxyEnv authoritative; a stray direct HTTP_PROXY is dropped).

Regression test: a direct env.HTTP_PROXY + NO_PROXY with no HTTP_PROXY_HOST passes through on both jobs-manager containers. Confirmed it fails (4 asserts) against the unconditional #236 template and passes against the gate. Render-verified both scenarios.

2. Restore Chart version/appVersion lockstep

The 1.6.0 bump (#231) moved version 1.5.1 → 1.6.0 but left appVersion at "1.5.1" — every prior release (1.1.0 … 1.5.1) bumped both together. tracebloc.labels emits app.kubernetes.io/version from .Chart.AppVersion, so the chart labelled every resource (and reported to cluster info, which reads that standard label) with a stale app version while helm.sh/chart was correct — two disagreeing version signals. The 1.6.1 bump sets both fields to 1.6.1.

3. Bump chart → 1.6.1

Ship #1 and #2 as 1.6.1 (per #238's "land as 1.6.1 / fast-follow") rather than folding into the unpublished 1.6.0.

---

Release sequencing

• 1.6.0 (from the frozen sync/develop-to-main-v1.6.0 branch behind Sync develop → main for v1.6.0 chart release #235) is unaffected — it ships, or not, as its own historical release without these fixes. develop moves to the 1.6.1 line here.
• After merge: a develop→main sync + GitHub Release v1.6.1 triggers release-helm-chart.yaml → publishes client-1.6.1 to gh-pages.

🤖 Generated with Claude Code

---

Note

Low Risk
Scoped to jobs-manager env templating and chart metadata; restores prior proxy passthrough when HTTP_PROXY_HOST is unset without changing the HTTP_PROXY_HOST-driven path.

Overview
Fixes an upgrade regression (#238) in jobs-manager proxy handling and bumps the Helm chart to 1.6.1 with aligned version / appVersion.

Proxy (#238): The jobs-manager template now builds the proxy-key exclusion list only when env.HTTP_PROXY_HOST is set—the same condition tracebloc.proxyEnv uses. With the host unset, direct env.HTTP_PROXY / NO_PROXY values pass through the generic .Values.env loop again (pre-1.6.0 behavior). With the host set, #229 behavior is unchanged: proxyEnv owns merged proxy vars and passthrough must not re-emit duplicates.

Chart: Chart.yaml moves to 1.6.1 for both version and appVersion.

Tests: New helm-unittest cases assert both jobs-manager containers keep verbatim HTTP_PROXY and NO_PROXY when HTTP_PROXY_HOST is absent.

^{Reviewed by Cursor Bugbot for commit 54feeee. Bugbot is set up for automated code reviews on this repo. Configure here.}