ci: persist authenticator/gateway appVersions + bump on manual rebuild by cyberantonz · Pull Request #1890 · constructorfabric/insight

cyberantonz · 2026-07-24T02:46:22Z

Problem

Backend service image versions are pinned via each service's subchart appVersion (set in publish-chart). Two gaps meant those bumps never reached the deployed stand:

Bumps not persisted (the revert bug). publish-chart bumps authenticator/gateway helm/Chart.yaml in the working tree, so the packaged chart artifact is momentarily correct — but the final git add in "Commit version bumps back to main" staged only analytics/identity/frontend. So the authenticator/gateway bumps were never committed. The next release re-anchors to main (where both are still "0.1.0") and republishes the umbrella with those services pinned to a non-existent 0.1.0 tag → deploy reverts them.

Evidence on main right now:
- identity subchart appVersion = a real build tag ✓ (it's in the git add list)
- authenticator = "0.1.0" ✗ (never persisted, despite many builds)
- gateway = "0.1.0" ✗
Manual full rebuild bumped nothing. The per-service bump gates on changes.<svc> == 'true' and bump-descriptors required event_name == 'push'. A workflow_dispatch full rebuild built every image but pinned none of the fresh tags.

Fix

Stage authenticator + gateway subchart Chart.yaml in the release commit so their bumps persist.
Bump every service subchart appVersion on a manual full rebuild (workflow_dispatch + empty frontend_tag), mirroring the build jobs' own trigger.
Allow bump-descriptors to run on workflow_dispatch (connectors already fan out via --all).

bump-descriptors's discover-images.outputs.any gate is intentionally left as-is: it only patches connector descriptors, so it's correctly skipped when no connector changed — the backend path is the subchart-appVersion mechanism above.

After merge

Trigger one manual full rebuild (Actions → Build & Push Container Images → Run workflow, no frontend_tag) to re-pin every service consistently from a single build.

Refs #1583

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Manual full-rebuild workflow runs now update version information for all applicable backend subcharts.
- Manual workflow triggers can now execute descriptor updates when required build conditions are met.
Bug Fixes
- Authenticator subchart version changes are now included in release commits.

The release pipeline pinned backend image versions via each service's subchart appVersion, but two gaps meant those versions never reached the stand: - publish-chart bumped authenticator/gateway/helm/Chart.yaml in the work tree (so the packaged chart was momentarily correct) but the commit step staged only analytics/identity/frontend. The bumps were never persisted, so the next release re-anchored to main (where both are still "0.1.0") and republished the umbrella with those services pinned to a non-existent 0.1.0 tag — reverting them on deploy. Stage authenticator and gateway too. (main currently shows identity=<build tag> but authenticator=gateway="0.1.0", confirming the drift.) - The per-service bump and bump-descriptors only fired on push. A manual workflow_dispatch full rebuild built every image but bumped nothing, so the freshly built tags were never pinned. Bump every service on a full rebuild (mirroring the build jobs' own trigger) and allow bump-descriptors to run on workflow_dispatch. After merge, a manual full rebuild re-pins every service consistently. Refs constructorfabric#1583 Signed-off-by: Anton Zelenov <antonz@constructor.tech>

coderabbitai · 2026-07-24T02:46:46Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 417441ad-0fa0-4bac-9861-73fd58fababa

📥 Commits

Reviewing files that changed from the base of the PR and between 9542911 and 597a10d.

📒 Files selected for processing (1)

.github/workflows/build-images.yml

📝 Walkthrough

Walkthrough

The build workflow now permits descriptor bumps during manual dispatches, updates all backend subchart appVersion values during full rebuilds, and stages the authenticator chart descriptor in release commits.

Changes

Chart versioning workflow

Layer / File(s)	Summary
Rebuild gating and version bumps `.github/workflows/build-images.yml`	`bump-descriptors` accepts `push` and `workflow_dispatch`; full rebuilds bump every backend subchart `appVersion`.
Release commit staging `.github/workflows/build-images.yml`	The release commit now stages the authenticator Helm `Chart.yaml`.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

release: service appVersion bump dropped when a merge also triggers a descriptor bump #1685 — Addresses service subchart version updates being omitted from publish-chart release commits.

Possibly related PRs

constructorfabric/insight#1838 — Also modifies backend subchart appVersion bump logic in build-images.yml.

Suggested reviewers: mitasovr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is clearly related to the main CI change: persisting backend appVersions and supporting manual rebuild bumps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…ld) (#1894) #1890 added the backend subchart appVersion bump + persistence, but only in publish-chart. On a manual full rebuild (or any run where a connector also changed), bump-descriptors commits the connector bumps and publish-chart is deferred to the re-triggered run via its `committed != 'true'` gate — so the backend bump never ran and only connectors got new versions (observed on run 30071800363). - Extract the per-service appVersion bump into scripts/bump-service-appversions.sh, shared by publish-chart and bump-descriptors so both pin the same set identically. - bump-descriptors now also bumps + stages the backend subchart Chart.yaml files in its (re-triggering) commit. The follow-up push run then rebuilds those backends and publish-chart persists their tags — backends end pinned to an image that exists, connectors keep their bumps. Refs #1583 Signed-off-by: Anton Zelenov <antonz@constructor.tech>

The bump-descriptors and "commit version bumps back to main" steps in build-images.yml staged a hardcoded list of backend subchart Chart.yaml files that never included src/backend/services/identity-resolution/helm/Chart.yaml (bump-service- appversions.sh does bump it correctly in the run's workspace — it's just never git-added, so the bump is silently discarded). constructorfabric#1890 fixed the identical gap for authenticator/gateway three days earlier; identity-resolution landed as a subchart the next day (constructorfabric#1918) and missed the same two lists. Because the umbrella chart's appVersion computation already reads this file (line ~1345, unaffected), the chart still "worked" on any release that also rebuilt identity-resolution in the same CI run — the bump landed in the workspace and got packaged, just never persisted to main. The first release afterward that didn't touch identity-resolution's source packaged whatever was last committed: the original "0.0.0-dev" placeholder, which isn't a real GHCR tag. On dev (where identityResolution.deploy is now true post-cutover), that rendered an unpullable image, the migrate initContainer got stuck in ImagePullBackOff, and the umbrella upgrade failed on its progress deadline and auto-rolled back — repeatedly, since nothing fixed the root cause between attempts. One-time restore: set appVersion back to the last known-good tag (2026.07.25.07.16-a122f77 — verified currently running on dev) so the next release packages an existing image instead of the placeholder. Signed-off-by: Sergei Mozhaev <mozhaev.dev@gmail.com>

cyberantonz requested a review from a team as a code owner July 24, 2026 02:46

Merge branch 'main' into fix/ci-persist-backend-appversions

9aff808

cyberantonz enabled auto-merge (squash) July 24, 2026 02:50

mitasovr approved these changes Jul 24, 2026

View reviewed changes

mozhaev-dev approved these changes Jul 24, 2026

View reviewed changes

Merge branch 'main' into fix/ci-persist-backend-appversions

0f0fb0a

cyberantonz merged commit 53dea91 into constructorfabric:main Jul 24, 2026
27 checks passed

cyberantonz mentioned this pull request Jul 24, 2026

ci: pin backend appVersions in bump-descriptors too (fix manual rebuild) #1894

Merged

cyberantonz deleted the fix/ci-persist-backend-appversions branch July 24, 2026 09:17

mozhaev-dev mentioned this pull request Jul 27, 2026

fix(ci): persist identity-resolution appVersion bumps back to main #1939

Merged

3 tasks

coderabbitai Bot mentioned this pull request Jul 27, 2026

fix(ci): trigger publish-chart when only identity-resolution changed #1943

Merged

2 tasks

Navigation Menu

Uh oh!

ci: persist authenticator/gateway appVersions + bump on manual rebuild - #1890

ci: persist authenticator/gateway appVersions + bump on manual rebuild#1890
cyberantonz merged 3 commits into
constructorfabric:mainfrom
cyberantonz:fix/ci-persist-backend-appversions

cyberantonz commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

cyberantonz commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

After merge

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cyberantonz commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading