.github/scripts/compute-version.test.js (1)

27-33: Extract deterministic test fixtures into shared constants.

The same now/gitSha literals are repeated across many assertions; centralizing them will reduce drift and make updates safer.

♻️ Suggested refactor

 import assert from "assert";
 import { computeVersion } from "./compute-version.js";
 
+const FIXED_NOW = new Date("2026-03-03T12:34:56Z");
+const FIXED_GIT_SHA = "abcdef1234567890";
+const DETERMINISTIC_OPTIONS = { now: FIXED_NOW, gitSha: FIXED_GIT_SHA };
+
 // ----------------------------------------------------------
 // CLI version tests
 // ----------------------------------------------------------
@@
-    computeVersion("main", "cli/v", {
-        now: new Date("2026-03-03T12:34:56Z"),
-        gitSha: "abcdef1234567890",
-    }),
+    computeVersion("main", "cli/v", DETERMINISTIC_OPTIONS),

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/scripts/compute-version.test.js around lines 27 - 33, Extract the
repeated test fixtures into shared constants and update assertions to use them:
define top-level constants (e.g., FIXED_NOW = new Date("2026-03-03T12:34:56Z")
and FIXED_GIT_SHA = "abcdef1234567890") in the test file and replace inline
literals in calls to computeVersion(...) with these constants (referencing
computeVersion from the diff); ensure all assertions use the shared FIXED_NOW
and FIXED_GIT_SHA so the fixtures are deterministic and centrally maintained.

.github/scripts/compute-version.js (1)

118-118: Consider adding an optional timestamp override in the action path for reproducible reruns.

computeVersionAction passes gitSha but not now, so rerunning the same commit can generate a different non-tag version. An optional env-driven timestamp keeps current behavior while enabling reproducible reruns when needed.

♻️ Suggested adjustment

 export default async function computeVersionAction({ core }) {
     const ref = process.env.REF;
     const tagPrefix = process.env.TAG_PREFIX;
     const gitSha = process.env.GITHUB_SHA;
+    const timestamp = process.env.VERSION_TIMESTAMP;
+    const now = timestamp ? new Date(timestamp) : undefined;
 
@@
     try {
-        const version = computeVersion(ref, tagPrefix, { gitSha });
+        if (timestamp && Number.isNaN(now.getTime())) {
+            core.setFailed("VERSION_TIMESTAMP must be a valid date/time");
+            return;
+        }
+        const version = computeVersion(ref, tagPrefix, { gitSha, now });

Also applies to: 131-131

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/scripts/compute-version.js at line 118, Add an optional timestamp
override so reruns can be reproducible: read an env var (e.g.,
process.env.VERSION_TIMESTAMP or process.env.NOW) into a new const (e.g., const
nowOverride) alongside the existing const gitSha = process.env.GITHUB_SHA, and
pass that value into computeVersionAction (or use it when building the version)
so the action uses the override when present but falls back to current time when
not provided; reference the existing gitSha variable and the
computeVersionAction call to locate where to add the new const and where to
forward the override.

.github/workflows/controller-release.yml (1)

68-74: ⚠️ Potential issue | 🟠 Major

Fetch tags in RC checkout to make tag idempotency checks reliable.

The local git rev-parse refs/tags/<tag> check can miss existing remote tags on reruns unless tags are fetched in checkout, which can cause a failing git push for an already-existing RC tag.

Suggested patch

       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           sparse-checkout: ${{ env.COMPONENT_PATH }}
           ref: ${{ github.event.inputs.branch }}
           token: ${{ steps.get_token.outputs.token }}
+          fetch-tags: true

#!/bin/bash
set -euo pipefail
FILE="$(fd -a controller-release.yml .github/workflows | head -n1)"
echo "Inspecting: $FILE"
sed -n '64,106p' "$FILE"
rg -n 'name: Checkout|fetch-tags|fetch-depth|rev-parse|refs/tags' "$FILE"

Expected: checkout in tag_rc currently lacks fetch-tags: true while Create tag relies on local tag refs.

Also applies to: 86-104

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/controller-release.yml around lines 68 - 74, The Checkout
step used in the release workflow doesn't fetch tags, so local checks like `git
rev-parse refs/tags/<tag>` can miss remote tags and cause duplicate-tag pushes
to fail; update the Checkout step (named "Checkout") used by the tag creation
flow (referenced by the `Create tag` step / `git rev-parse` logic) to enable
fetching tags (add the checkout option to fetch tags, e.g., set fetch-tags:
true) so remote tags are available locally before the tag existence/idempotency
check runs.

.github/workflows/controller-release.yml (1)

407-419: ⚠️ Potential issue | 🟠 Major

Final release publication is still not rerun-idempotent.

createRelease is unconditional here. On reruns after partial success, this can fail with tag_name already exists, and duplicate asset names can also fail upload. Switch to get-or-create/update release and replace same-name assets before upload.

Suggested patch

-            const isLatest = setLatest === 'true';
-            const created = await github.rest.repos.createRelease({
-              owner: context.repo.owner, repo: context.repo.repo,
-              tag_name: finalTag, name: `Controller ${finalVersion}`,
-              body: notes, prerelease: false, make_latest: isLatest ? 'true' : 'false',
-            });
+            const isLatest = setLatest === 'true';
+            let releaseResp;
+            try {
+              releaseResp = await github.rest.repos.getReleaseByTag({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                tag: finalTag,
+              });
+              releaseResp = await github.rest.repos.updateRelease({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                release_id: releaseResp.data.id,
+                tag_name: finalTag,
+                name: `Controller ${finalVersion}`,
+                body: notes,
+                prerelease: false,
+                make_latest: isLatest ? 'true' : 'false',
+              });
+            } catch (e) {
+              if (e.status !== 404) throw e;
+              releaseResp = await github.rest.repos.createRelease({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                tag_name: finalTag,
+                name: `Controller ${finalVersion}`,
+                body: notes,
+                prerelease: false,
+                make_latest: isLatest ? 'true' : 'false',
+              });
+            }
+            const releaseId = releaseResp.data.id;
+            const existingAssets = (await github.rest.repos.listReleaseAssets({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: releaseId,
+              per_page: 100,
+            })).data;
             
             // Upload chart from local dist/ directory (no registry pull needed)
             for (const file of fs.readdirSync(chartDir).filter(f => f.endsWith('.tgz'))) {
+              const prior = existingAssets.find(a => a.name === file);
+              if (prior) {
+                await github.rest.repos.deleteReleaseAsset({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  asset_id: prior.id,
+                });
+              }
               const data = fs.readFileSync(path.join(chartDir, file));
               await github.rest.repos.uploadReleaseAsset({
-                owner: context.repo.owner, repo: context.repo.repo, release_id: created.data.id,
+                owner: context.repo.owner, repo: context.repo.repo, release_id: releaseId,
                 name: file, data, headers: { 'content-type': 'application/gzip', 'content-length': data.length },
               });
             }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/controller-release.yml around lines 407 - 419, The current
logic calls github.rest.repos.createRelease unconditionally and then uploads
assets, which breaks on reruns (tag already exists or duplicate asset names);
change this to a get-or-create/update flow: call
github.rest.repos.getReleaseByTag (or list releases) for finalTag, if found use
github.rest.repos.updateRelease to ensure release metadata is up-to-date and set
created to that release, otherwise call createRelease; before each
uploadReleaseAsset for files from fs.readdirSync(chartDir).filter(...), check
the release's existing assets (created.data.assets) and if an asset with the
same name exists call github.rest.repos.deleteReleaseAsset for that asset id to
remove it, then proceed to uploadReleaseAsset as before so reruns are
idempotent.

.github/scripts/create-tag.js (1)

84-102: Async function without await could be simplified.

createRcTag and createFinalTag are declared async but don't use await. While this works (they implicitly return a resolved Promise), it's slightly misleading. Consider removing async or keeping it for consistency if the caller expects a Promise.

This is a minor nitpick and doesn't affect functionality.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/scripts/create-tag.js around lines 84 - 102, The functions
createRcTag (and similarly createFinalTag) are declared async but contain no
await; remove the unnecessary async keyword from their declarations to avoid
misleading callers, or alternatively keep async and explicitly return a Promise
(e.g., return void/Promise.resolve) if external code relies on them being async;
update the function signatures for createRcTag and createFinalTag accordingly
and ensure callers (and exports) still work with the new non-async synchronous
return.

.github/scripts/publish-final-release.js (1)

111-119: Asset listing limited to 100 items.

listReleaseAssets uses per_page: 100 without pagination. If a release has more than 100 assets (unlikely but possible), duplicate detection would miss assets beyond page 1.

For controller releases with typically few chart assets, this is low risk.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/scripts/publish-final-release.js around lines 111 - 119, The current
uploadAssets function uses github.rest.repos.listReleaseAssets with per_page:
100 and doesn't paginate, so assets beyond the first page can be missed; update
uploadAssets to paginate and collect all assets (e.g., loop over page numbers or
use Octokit's pagination helper) when calling listReleaseAssets for the given
releaseId, merge all pages into the existing array before doing duplicate
detection, and keep references to uploadAssets, listReleaseAssets, releaseId and
existing to locate and modify the code.

kubernetes/controller/chart/test-values.yaml (1)

6-6: Add a digest render fixture for the new image path.

task helm/template still renders only this tag-based fixture, so the new repository@digest branch in chart/templates/manager/manager.yaml is currently unexercised. A second fixture, or an extra render with manager.image.digest=sha256:..., would keep that path under chart validation.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@kubernetes/controller/chart/test-values.yaml` at line 6, The current
test-values.yaml only exercises the tag-based image path (tag: 0.0.0-main) so
the new repository@digest rendering branch in
chart/templates/manager/manager.yaml is untested; add a second fixture that sets
manager.image.repository and manager.image.digest (e.g.,
manager.image.digest=sha256:...) or modify the test harness to run an additional
helm/template render with manager.image.digest populated so the
repository@digest path in manager.yaml is exercised and validated.