ci: pin backend appVersions in bump-descriptors too (fix manual rebuild)

[cyberantonz]

Why #1890 wasn't enough

#1890 added the backend subchart appVersion bump + persistence, but only inside publish-chart. On a manual full rebuild (run 30071800363), bump-descriptors committed the connector bumps and publish-chart was skipped — its needs.bump-descriptors.outputs.committed != 'true' gate defers it to the re-triggered push run. So the backend bump never executed.

The re-triggered push run (from the connector-descriptor commit) doesn't see any backend source as changed, so backends aren't rebuilt or bumped there either. Net result: connectors bumped, backends not — exactly what was observed.

This affects every run where bump-descriptors commits: a manual full rebuild, or any push that changes a backend and a connector together.

Fix

• Extract the per-service appVersion bump into scripts/bump-service-appversions.sh, shared by publish-chart and bump-descriptors so both pin the same set of services identically.
• bump-descriptors now also bumps + stages the backend subchart Chart.yamls in its (re-triggering) commit. The follow-up push run then sees those backends as changed, rebuilds them, and publish-chart persists their tags (via the git-add from ci: persist authenticator/gateway appVersions + bump on manual rebuild #1890). Backends end pinned to an image that exists; connectors keep their bumps.

Flow after this change

Manual full rebuild (workflow_dispatch, no frontend_tag):

1. All images build at tag T1; bump-descriptors patches connector descriptors and bumps all backend appVersions → one commit (no [skip ci]) → re-trigger.
2. Re-triggered push run: toolbox rebuilds against patched descriptors, backends rebuild (their Chart.yaml changed), publish-chart runs and persists every backend appVersion + publishes the umbrella.

Backend-only push (unchanged): bump-descriptors is skipped (no connector), publish-chart bumps + persists directly (the #1890 path).

Trade-off

On the full-rebuild / combined-push paths the backends build a second time in the re-triggered run. Those events are infrequent (manual re-pin, or a PR touching both a backend and a connector), so the extra build is acceptable in exchange for a single canonical chart publish.

Refs #1583

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved release automation to keep backend service chart versions synchronized with built images.
  • Added consistent handling for targeted service builds and full rebuilds.
  • Streamlined chart version updates across publishing workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d8afe366-19a3-4ccb-8398-22553ed1783f

📥 Commits

Reviewing files that changed from the base of the PR and between 4e36dbb and f5ca800.

📒 Files selected for processing (2)

• .github/workflows/build-images.yml
• .github/workflows/scripts/bump-service-appversions.sh

---

📝 Walkthrough

Walkthrough

The image build workflow now shares a script for conditionally updating backend service Helm chart appVersion values. The descriptor job stages these updates with connector descriptor changes, while the chart publishing job reuses the same script.

Changes

Backend service appVersion bumping

Layer / File(s)	Summary
Shared appVersion bump script .github/workflows/scripts/bump-service-appversions.sh	Adds strict flag-driven updates for four backend service charts using BUILD_TAG, FULL_REBUILD, and per-service build flags.
Workflow integration and commit staging .github/workflows/build-images.yml	Invokes the shared script from descriptor and chart publishing jobs and stages backend helm/Chart.yaml files in descriptor commits.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• constructorfabric/insight issue 1685 — Covers moving service appVersion bumping into the canonical descriptor workflow path and sharing the implementation.

Possibly related PRs

• constructorfabric/insight#1298 — Also updates backend chart appVersion handling in build-images.yml.
• constructorfabric/insight#1838 — Also changes backend service chart appVersion updates in publishing workflows.
• constructorfabric/insight#1890 — Also handles service appVersion bumps and commits during full rebuilds.

Suggested reviewers: mitasovr

Sequence Diagram(s)

sequenceDiagram
  participant BuildWorkflow
  participant BumpScript
  participant ServiceCharts
  participant GitCommit
  BuildWorkflow->>BumpScript: pass BUILD_TAG and service flags
  BumpScript->>ServiceCharts: update selected appVersion values
  BuildWorkflow->>GitCommit: stage Chart.yaml files
  GitCommit->>GitCommit: commit descriptor and chart changes

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: pinning backend appVersions in bump-descriptors to fix manual rebuild behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}