ci: pin backend appVersions in bump-descriptors too (fix manual rebuild)

.github/workflows/build-images.yml

@@ -972,6 +972,24 @@ jobs:
               .github/workflows/scripts/bump-descriptor-version.sh --descriptor "$desc"
             done
 
+      # Pin backend service subchart appVersions here too. This job commits
+      # WITHOUT [skip ci] and re-triggers the workflow; because publish-chart
+      # is deferred to that follow-up run (see its `committed != 'true'`
+      # gate), a backend built alongside a connector — or every backend on a
+      # manual full rebuild — would otherwise never get pinned: the follow-up
+      # run doesn't see the backend source as changed. Bumping the subchart
+      # Chart.yaml here makes the follow-up run rebuild that backend and
+      # publish-chart persist its tag. Uses the same script as publish-chart.
+      - name: Bump per-service subchart appVersions (built this run)
+        env:
+          BUILD_TAG: ${{ needs.changes.outputs.build_tag }}
+          FULL_REBUILD: ${{ github.event_name == 'workflow_dispatch' && inputs.frontend_tag == '' }}
+          ANALYTICS: ${{ needs.changes.outputs.analytics }}
+          AUTHENTICATOR: ${{ needs.changes.outputs.authenticator }}
+          GATEWAY: ${{ needs.changes.outputs.gateway }}
+          IDENTITY: ${{ needs.changes.outputs.identity }}
+        run: .github/workflows/scripts/bump-service-appversions.sh
+
       - name: Commit descriptor patches (no [skip ci])
         id: commit
         env:
@@ -989,6 +1007,13 @@ jobs:
             | sort -u \
             | xargs -r git add
 
+          # Stage any backend subchart appVersion bumps from the step above.
+          # git add of an unchanged file is a harmless no-op.
+          git add src/backend/services/analytics/helm/Chart.yaml \
+                  src/backend/services/authenticator/helm/Chart.yaml \
+                  src/backend/services/gateway/helm/Chart.yaml \
+                  src/backend/services/identity/helm/Chart.yaml
+
           if git diff --staged --quiet; then
             echo "no descriptor changes to commit"
             echo "committed=false" >> "$GITHUB_OUTPUT"
@@ -1127,7 +1152,10 @@ jobs:
       # tag in the published chart still resolves to an image that exists.
       # A manual full rebuild (workflow_dispatch, no frontend_tag) rebuilds
       # every service image, so it bumps every service — mirroring the build
-      # jobs' own `workflow_dispatch && frontend_tag == ''` trigger.
+      # jobs' own `workflow_dispatch && frontend_tag == ''` trigger. When
+      # bump-descriptors runs (connectors changed / full rebuild) it does the
+      # bump instead, in its re-triggering commit; this step is the canonical
+      # path when no connector changed and bump-descriptors was skipped.
       - name: Bump per-service subchart appVersions
         env:
           BUILD_TAG: ${{ needs.changes.outputs.build_tag }}
@@ -1136,24 +1164,7 @@ jobs:
           AUTHENTICATOR: ${{ needs.changes.outputs.authenticator }}
           GATEWAY: ${{ needs.changes.outputs.gateway }}
           IDENTITY: ${{ needs.changes.outputs.identity }}
-        run: |
-          set -euo pipefail
-          if [ "$ANALYTICS" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then
-            echo "Bumping analytics subchart appVersion → $BUILD_TAG"
-            yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/analytics/helm/Chart.yaml
-          fi
-          if [ "$AUTHENTICATOR" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then
-            echo "Bumping authenticator subchart appVersion → $BUILD_TAG"
-            yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/authenticator/helm/Chart.yaml
-          fi
-          if [ "$GATEWAY" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then
-            echo "Bumping gateway subchart appVersion → $BUILD_TAG"
-            yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/gateway/helm/Chart.yaml
-          fi
-          if [ "$IDENTITY" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then
-            echo "Bumping identity subchart appVersion → $BUILD_TAG"
-            yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/identity/helm/Chart.yaml
-          fi
+        run: .github/workflows/scripts/bump-service-appversions.sh
 
       # Cross-repo frontend bump. The frontend lives in
       # constructorfabric/insight-front and builds its own image; on

.github/workflows/scripts/bump-service-appversions.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Bump each backend service subchart's appVersion to $BUILD_TAG when that
+# service's image was (re)built this run: its paths-filter flag is 'true', or
+# this is a manual full rebuild (FULL_REBUILD=true).
+#
+# Shared by the bump-descriptors and publish-chart jobs so both pin the exact
+# same set of services in the same way. A service that wasn't built is left
+# untouched — it keeps its previous appVersion, which still resolves to an
+# image that exists.
+#
+# Env: BUILD_TAG (required), FULL_REBUILD (default false), and one flag per
+# service (ANALYTICS/AUTHENTICATOR/GATEWAY/IDENTITY) carrying the paths-filter
+# output ('true' when that service changed).
+set -euo pipefail
+
+: "${BUILD_TAG:?BUILD_TAG is required}"
+FULL_REBUILD="${FULL_REBUILD:-false}"
+
+# service-flag-env : subchart Chart.yaml
+services=(
+  "ANALYTICS:src/backend/services/analytics/helm/Chart.yaml"
+  "AUTHENTICATOR:src/backend/services/authenticator/helm/Chart.yaml"
+  "GATEWAY:src/backend/services/gateway/helm/Chart.yaml"
+  "IDENTITY:src/backend/services/identity/helm/Chart.yaml"
+)
+
+for entry in "${services[@]}"; do
+  flag_name="${entry%%:*}"
+  chart="${entry#*:}"
+  flag_val="${!flag_name:-false}"
+  if [ "$flag_val" = "true" ] || [ "$FULL_REBUILD" = "true" ]; then
+    echo "Bumping $chart appVersion -> $BUILD_TAG"
+    yq -i ".appVersion = \"$BUILD_TAG\"" "$chart"
+  fi
+done