build(refactor-release)!: pin chart images to full release versions - #12953
Draft
DariuszPorowski wants to merge 1 commit into
Draft
build(refactor-release)!: pin chart images to full release versions#12953DariuszPorowski wants to merge 1 commit into
DariuszPorowski wants to merge 1 commit into
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
DariuszPorowski
added this pull request to stack #12738
September 10, 2026 02:17
This was referenced Sep 10, 2026
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The implicit-default test does not model an absent override, and the documentation gives incorrect instructions for clearing component image overrides.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Pins Helm chart images to complete release versions and updates release verification, OCI tagging, upgrade tests, and migration documentation.
Changes:
- Uses full
Chart.AppVersionimage tags. - Pins and verifies external release images.
- Adds upgrade coverage and patch-pickup guidance.
File summaries
| File | Description |
|---|---|
.github/scripts/prepare-release_test.sh |
Tests release-note warnings. |
.github/scripts/release-cutover_test.sh |
Verifies publication ordering. |
.github/scripts/release-oci-artifacts.sh |
Adds guarded OCI image tagging. |
.github/scripts/release-oci-artifacts_test.sh |
Tests external image pinning. |
.github/scripts/release-parity-manifest.sh |
Inspects staged full-version images. |
.github/scripts/release-parity-manifest_test.sh |
Tests staged external references. |
.github/scripts/release-verification.sh |
Expects full-version image tags. |
.github/scripts/release-verification_test.sh |
Tests public installation verification. |
.github/scripts/verify-release-manifest.mjs |
Enforces full-version references. |
.github/scripts/verify-release-manifest_test.mjs |
Tests rejection of channel tags. |
.github/scripts/verify-release-publication.sh |
Verifies version-pinned Deployment Engine. |
.github/workflows/__build-helm-chart.yaml |
Pins external images before packaging. |
deploy/Chart/README.md |
Documents image-tag migration. |
deploy/Chart/templates/_helpers.tpl |
Removes stable-version truncation. |
deploy/Chart/tests/helpers_test.yaml |
Tests final and patch defaults. |
docs/contributing/contributing-releases/README.md |
Updates release prerequisites and behavior. |
docs/release-notes/template.md |
Adds final-release migration notice. |
docs/release-notes/template_patch.md |
Adds patch-release migration notice. |
eng/design-notes/tools/2026-03-goreleaser-release-lifecycle-implementation-plan.md |
Documents phase 17 design. |
pkg/cli/helm/helmclient_test.go |
Tests Helm upgrade semantics. |
Review details
- Files reviewed: 20/20 changed files
- Comments generated: 4
- Review effort level: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+72
to
+76
| values := map[string]any{ | ||
| "global": map[string]any{"imageTag": testCase.storedTag}, | ||
| "rp": map[string]any{"publicEndpointOverride": "retained.example.test"}, | ||
| "preupgrade": map[string]any{"enabled": true}, | ||
| } |
|
|
||
| **Patch updates require a chart upgrade.** Restarting pods no longer picks up a later patch through the moving `major.minor` alias. Upgrade the Radius CLI and run `rad upgrade kubernetes`, or upgrade to the desired chart version with Helm. Channel aliases remain published for existing consumers. | ||
|
|
||
| An upgrade adopts the new defaults when the previous installation used chart defaults. Explicit `global.imageTag`, component tags, and tagged or digest-pinned image paths remain respected. To remove a stored global channel override while preserving other user settings, use `rad upgrade kubernetes --set global.imageTag=`. Clear any component-specific tag or image overrides separately; `--reset-values` also discards unrelated stored settings. |
|
|
||
| ## Upgrading to Radius vX.Y.Z | ||
|
|
||
| **Helm image pinning:** This release's Helm chart pins Radius component images to the full release version. Restarting pods no longer picks up later patches implicitly; upgrade the chart to receive patched images. Existing channel aliases remain available, and explicitly configured `global.imageTag`, component tags, or image references keep overriding chart defaults. Clear those overrides to adopt version-pinned defaults while retaining other settings. |
|
|
||
| This patch release includes the fixes listed in the [changelog](#changelog). | ||
|
|
||
| **Helm image pinning:** This release's Helm chart pins Radius component images to the full patch version. Restarting pods no longer picks up later patches implicitly; upgrade your CLI and run `rad upgrade kubernetes` to update the chart and images. Explicit channel-tag or image overrides remain respected; clear them to adopt version-pinned defaults. |
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 10, 2026 19:28
7ec2c5f to
3ee6d6e
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dp/release-publication-gate #12953 +/- ##
===============================================================
+ Coverage 59.77% 59.83% +0.06%
===============================================================
Files 778 778
Lines 45916 45916
===============================================================
+ Hits 27445 27474 +29
+ Misses 18471 18442 -29 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Functional Tests - upgrade-noncloud1 tests 0 ✅ 5m 5s ⏱️ For more details on these failures, see this check. Results for commit af4029a. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 10, 2026 20:32
3ee6d6e to
c930cca
Compare
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 10, 2026 20:47
c930cca to
a8ba6fe
Compare
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 10, 2026 20:56
a8ba6fe to
1ab9d33
Compare
Functional Tests - kubernetes-noncloud23 tests 23 ✅ 8m 8s ⏱️ Results for commit 6a7bf54. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 10, 2026 21:41
1ab9d33 to
d3e659e
Compare
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
2 times, most recently
from
September 10, 2026 21:57
17f1f4c to
fb17fff
Compare
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 10, 2026 22:27
fb17fff to
5bbff86
Compare
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
2 times, most recently
from
September 11, 2026 04:01
99381a0 to
f0a0e28
Compare
Functional Tests - corerp-cloud32 tests 31 ✅ 21m 31s ⏱️ Results for commit d0322f1. ♻️ This comment has been updated with latest results. |
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 11, 2026 04:29
f0a0e28 to
d0322f1
Compare
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 11, 2026 05:51
d0322f1 to
6a7bf54
Compare
BREAKING CHANGE: Default stable chart images no longer pick up newer patches on pod restart. Upgrade the chart to update images; explicit tag overrides remain respected. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
dp/helm-immutable-image-tags
branch
from
September 11, 2026 06:12
6a7bf54 to
af4029a
Compare
❌ Spellcheck FailedThere are spelling errors in your PR. Visit the workflow output to see what words are failing. Adding new wordsYou can add new custom words to .cspellignore. |
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implement phase 17 of the GoReleaser release lifecycle above #12948 in stack #12738.
Chart.AppVersionfor final and patch image defaults, preserving RC/edge behavior, custom registries, and explicit tag or image overrides. Existing channel aliases remain published.No new files or dependencies are introduced.
Breaking change: With chart defaults, restarting pods no longer picks up later patches through moving channel aliases. Upgrade the chart to update the images. Explicit tag and image overrides remain respected.
Draft rollout gates:
org.opencontainers.image.revisionwith the built commit SHA, then verify a source-labeled release image. The currently inspected dashboard build command and Dockerfile do not emit this label; source verification deliberately fails closed rather than adopting an unproven image.GITHUB_TOKENpackage-write job.Keep this PR and every earlier stack PR in draft. This PR does not modify the dashboard repository or package permissions.
Reason for change
Stable charts currently truncate image tags to major/minor, allowing a pod restart to pick up images from a different patch than the installed chart. Pinning chart defaults to the release version removes that implicit patch pickup. Native image tagging supplies the external full-version references without creating another build path, and existing Helm upgrade semantics preserve intentional user overrides.
Fixes #12815
How to test
Completed local validation:
helm unittest deploy/Chart: all 136 tests pass, including 81 helper tests.go test ./pkg/cli/helm -count=1: passes, including three native install/upgrade regression cases. Repeated after signing was unblocked; no staged content changed during the pause.make test-release-publication test-release-cutover test-release-oci-artifacts test-release-parity-manifest test-prepare-release test-release-plan test-release-sboms test-release-version-format: passes.git diff --checkpass on the changed scope.Helm upgrade tests use Helm's real actions and release storage with a fake Kubernetes client; CRD installation is excluded from that fixture. Live cluster/registry validation, dashboard publisher changes, package access configuration, and
cspellwere not run. These remain explicit rollout gates, not claimed acceptance results.File change summary
deploy/Chart/templates/_helpers.tpl,deploy/Chart/tests/helpers_test.yamlpkg/cli/helm/helmclient_test.go.github/scripts/release-oci-artifacts{,_test}.sh.github/workflows/__build-helm-chart.yaml,.github/scripts/release-cutover_test.sh.github/scripts/verify-release-manifest{,_test}.mjs,verify-release-publication.sh.github/scripts/release-parity-manifest{,_test}.sh,release-verification{,_test}.shdocs/release-notes/template*.md,.github/scripts/prepare-release_test.sh