fix(release): pin AuthBridge injection images + guard against :latest (#508)

[cwiklik]

Summary

The operator chart pinned the cortex-built AuthBridge injection images (authbridge, authbridge-envoy, authbridge-lite, proxy-init) at :latest in charts/operator/values.yaml. release.yml only pins the controller-manager image, so every published operator-chart shipped :latest for the injected images — non-reproducible (surfaced during the v0.7.0 GA cut).

Changes

• Pin the 4 AuthBridge injection images :latest → v0.7.0-alpha.3 (current cortex release; all 4 images published).
• Guard in release.yml: fail the release if any injected image is a floating tag (:latest/:main/:master) — so it can't regress silently.

Closes #508

Assisted-By: Claude Code

[huang195]

Dobra robota — the pin is correct and verified: v0.7.0-alpha.3 is cortex's current release (published 14 min before this PR) and cortex's Build-Publish matrix tags all four images with github.ref_name on tag push, run green. Guard logic is sound (CHARTS_PATH resolves, grep under if is errexit-safe).

Three non-blocking notes: the guard fires after the operator images are already pushed, it's a 3-tag deny-list rather than a positive pin assertion, and the compiled Go defaults in defaults.go still carry :latest where the grep can't reach them.

One question: the guard happily passes a prerelease tag, so operator v0.7.0 GA would ship cortex alpha images. Intended, or does the GA cut need a re-pin once cortex has a v0.7.0?

---

Areas reviewed: CI/GitHub Actions, Helm values · Agent/IDE config (.claude/.vscode): none · Commits: 1, all signed-off: yes · CI: 16 pass, E2E pending

Assisted-By: Claude Code

[huang195]

Guard sits in the release job, which is needs: build-and-push + if: ref_type == 'tag'. By the time it fails, kagenti-operator and agentcard-signer are already built and pushed to ghcr with the release tag — half-published release (images out, chart not), manual cleanup.

Two cheaper spots: a pre-flight job that build-and-push depends on, or the Helm Chart Lint job in security-scans.yaml which runs on every PR — then a :latest regression is caught at review time, not mid-release.

[huang195]

Deny-list of 3 tag names + hardcoded registry path. These all pass the guard:

• no tag at all (.../authbridge-envoy → implicit :latest)
• :dev / :edge / :nightly
• any move off ghcr.io/kagenti/kagenti-extensions/

Positive assertion is strictly tighter, and yq is already installed in this job:

for k in envoyProxy authbridge authbridgeLite proxyInit; do
  img=$(yq ".defaults.images.$k" values.yaml)
  [[ "$img" =~ :v[0-9]+\.[0-9]+\.[0-9]+ ]] || { echo "::error::defaults.images.$k not version-pinned: $img"; exit 1; }
done

Keys the check on the 4 values that matter instead of on the registry string.

[huang195]

Chart layer pinned, compiled fallback not: operator/internal/webhook/config/defaults.go:34-45 still has all four at :latest, and loader.go:45 overlays the ConfigMap on top of CompiledDefaults() (fields absent from the file keep the compiled value). So any deploy without kagenti-platform-config — kustomize make deploy, or webhook.enable=false where the ConfigMap isn't rendered — still injects :latest. The new grep only reads values.yaml, so it will never catch it.

defaults.go already carries a Keep in sync with charts/operator/values.yaml comment for the spiffe-helper config; same treatment fits here.

Related: operator/test/e2e/e2e_suite_test.go:66-69 still pulls :latest (and is missing authbridge-lite), so e2e never exercises the images the chart actually ships.