[onedr0p]

Warning

Breaking change. gatus.image.digest has been removed. Move the digest into gatus.image.tag as tag@sha256:…. Setting the old key now fails the render with that instruction, rather than being ignored silently and leaving you believing the image is pinned when it is not. sidecar.image.digest is unaffected — the release pipeline writes it.

BREAKING CHANGE: gatus.image.digest removed; put the digest in gatus.image.tag as tag@sha256:….

Ports home-operations/tuppr#414 + home-operations/tuppr#415 to this repo.

What

The chart's in-repo version was a 0.0.0 placeholder that only got a real value at package time, so the committed Chart.yaml and the generated chart README advertised a version no released chart ever carries. release-please now stamps it:

• charts/gatus-sidecar/Chart.yaml: version: 0.3.6 # x-release-please-version (0.3.6 is the current released version per .release-please-manifest.json).
• release-please-config.json: extra-files lists the Chart.yaml as {"type": "generic"} plus the generated README. The typed form is the crux: a bare string path ending in .yaml makes release-please pick its YAML updater, which re-serializes the document (stripping every comment) and never honors the annotation.
• charts/gatus-sidecar/README.md.gotmpl: the badges are hand-rolled instead of chart.badgesSection. The updater rewrites only the first semver on an annotated line, and the default badge form would have its -informational suffix swallowed as a prerelease, so the Version badge uses the static/v1 query form (version followed by &) and keeps the version out of its alt text.

appVersion special case

appVersion is deliberately not stamped, and only the Version badge carries an annotation.

Unlike the sibling repos, this chart's appVersion tracks upstream Gatus rather than this repo: the release job packages with --app-version "${GATUS_TAG}", where GATUS_TAG is read from .gatus.image.tag in values.yaml (Renovate-pinned). Two things follow:

• Stamping the sidecar repo's version there would make the committed copy claim something every released chart contradicts.
• Hardcoding today's gatus tag (v5.36.0) would be true only until the next Renovate bump of .gatus.image.tag, and nothing refreshes Chart.yaml on that bump, so it would silently rot into a second, wrong source of truth. values.yaml stays the single source the release reads.

So the field keeps its always-overridden-at-package-time placeholder, with comments in Chart.yaml and README.md.gotmpl explaining that it tracks upstream Gatus and must not gain an x-release-please-version annotation, so a future reader does not "fix" it.

Chart unit test

The sidecar image tag defaults to .Chart.Version (not appVersion), so the assertion that hardcoded the placeholder now asserts the repo:semver shape. Note this chart runs the sidecar as a native sidecar, so the adjusted assertion is on initContainers[0]; the gatus assertions on containers[0] (including the appVersion fallback and the digest pin) are untouched.

Verification

All run locally on this branch:

Gate	Result
mise run helm-lint	pass: 1 chart(s) linted, 0 chart(s) failed (pre-existing icon is recommended info)
mise run helm-unittest	pass: 6 passed, 6 total suites, 51 passed, 51 total tests
mise run generate-check	pass (README regenerated and committed; git diff --exit-code clean)
mise run vet	pass
lefthook run pre-commit	pass (format-json, format-yaml, generate all clean)
helm template sanity	renders helm.sh/chart: gatus-sidecar-0.3.6

release-please-config.json also picked up one unrelated formatter-canonical line (exclude-paths collapsed to a single line) from the repo's format-json pre-commit hook.

[greptile-apps]

Greptile Summary

Updates Helm chart release metadata and image pinning behavior.

• Stamps chart and application versions through release-please and the release workflow.
• Pins the default Gatus image through gatus.image.tag and rejects nonempty uses of the removed gatus.image.digest.
• Updates generated documentation, schema output, release configuration, and chart tests for the new behavior.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure eligible for this follow-up review remains.

No blocking failure remains.

T-Rex Logs

What T-Rex did

• The team validated that the before/after captures align on tooling blockers at equivalent scope, indicating the setup-level comparison rather than runtime chart rendering behavior.
• They concluded that runtime verification could not verify several items: chart version 0.3.6, pinned Gatus image output, removal of digest rejection, and the sidecar Chart.Version default.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/release.yaml	Packages releases with the repository release version as both chart version and appVersion.
charts/gatus-sidecar/Chart.yaml	Replaces placeholder metadata with release-please-stamped chart and application versions.
charts/gatus-sidecar/templates/_helpers.tpl	Requires the pinned Gatus tag and emits a migration error for a nonempty removed digest value.
charts/gatus-sidecar/values.yaml	Moves the Gatus digest into the image tag and retains release-time sidecar digest pinning.
charts/gatus-sidecar/values.schema.json	Regenerates the values schema after removing the standalone Gatus digest property.
charts/gatus-sidecar/tests/deployment_test.yaml	Updates image assertions and adds coverage for required tags and legacy digest handling.
release-please-config.json	Adds generated chart metadata files to release-please version updates.

_{Reviews (6): Last reviewed commit: "feat(helm)!: remove gatus.image.digest" | Re-trigger Greptile}

[onedr0p]

Reworked per review: appVersion is now this repo's own release (0.3.6, release-please-stamped) rather than a documented 0.0.0 placeholder, so this chart matches every sibling instead of being the one where appVersion means something else. The chart and the sidecar ship together, so both fields are the same version.

The Gatus version stays where it already was — .gatus.image.tag in values.yaml, which is what Renovate bumps and what the pod actually runs. The release now packages with --app-version \"${VERSION}\"; the guard that fails packaging on an unset gatus tag is unchanged.

One behavioural consequence worth calling out: appVersion is no longer a usable fallback for the Gatus tag (falling back would render ghcr.io/twin/gatus:0.3.6, which does not exist), so that tag is now required unless gatus.image.digest is set. The test that asserted the old fallback now asserts the failure, and a new test covers the pinned-tag path.

Verified: default render gives ghcr.io/twin/gatus:v5.36.0 + ghcr.io/home-operations/gatus-sidecar:0.3.6; an empty tag fails with gatus.image.tag is required unless gatus.image.digest is set; helm-lint, helm-unittest (52 tests) and generate-check all pass.

[onedr0p]

Added the gatus digest pin (88e3d23).

gatus.image.tag is now v5.36.0@sha256:c5f210d0… rather than a floating tag, so two installs of the same chart version can no longer land on different images. The reference renders as ghcr.io/twin/gatus:v5.36.0@sha256:… — immutable, and still readable in a pod spec.

On the Renovate side: this needs no new config. It is the same tag@sha256:digest form that tests.image.tag in this same file already uses, and the built-in helm-values manager parses both halves out of the single field. Confirmed with a local renovate --platform=local --dry-run=extract against a bare config (no custom managers):

"depName": "ghcr.io/twin/gatus",
"currentValue": "v5.36.0",
"currentDigest": "sha256:c5f210d095fa78e6efaa20ffeb14803f2ba4f10615e16a6d12087697149617f0",
"replaceString": "v5.36.0@sha256:c5f210d0…",
"autoReplaceStringTemplate": "{{newValue}}{{#if newDigest}}@{{newDigest}}{{/if}}"

Because both halves live in one field behind one replaceString, the tag and digest cannot drift apart.

I first built this as a separate digest: value driven by a custom regex manager, since the built-in manager has no separate digest field. That did work — extraction and lookup were both verified, including a packageRule to stop the two managers rewriting the same lines — but the inline form matches existing convention in this very file and needs zero Renovate config, so I dropped it.

gatus.image.digest keeps its previous meaning: set it to pin by digest alone and drop the tag from the reference.

Verification: the digest resolves to the byte-identical multi-arch index for v5.36.0 (application/vnd.oci.image.index.v1+json, linux/amd64+arm+arm64); the default render gives ghcr.io/twin/gatus:v5.36.0@sha256:…; the digest-only override still gives ghcr.io/twin/gatus@sha256:…; and helm-lint, helm-unittest (52 tests) and generate-check all pass.