fix(helm): track the app release in appVersion, and enforce it

appVersion sat at v0.8.18 while the app shipped through v0.8.24 -- six
releases. Because the image tags default to Chart.AppVersion, a default
`helm install` deployed the older Sim, and regenerating images.yaml here
moved eleven lines, so the mirror inventory an air-gapped operator works
from named the wrong images too.

Publishing is what makes this serious. Cloning main got you whatever was
there; a published chart version is immutable, so every stale appVersion
would be frozen and installable forever.

It was bumped by hand and nothing checked it, which is why it drifted. The
publish job now refuses to publish when appVersion does not match the latest
GitHub release, comparing against the release API rather than a hardcoded
value so the check cannot go stale itself. Confirmed it fires on exactly the
drift that existed (v0.8.18 vs v0.8.24) and passes now that it is fixed.

Bumps appVersion to v0.8.24, regenerates images.yaml, and takes the chart to
1.9.5.

Author: waleedlatif1

.github/workflows/helm.yml

@@ -249,6 +249,31 @@ jobs:
             echo "repository=ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts/${name}"
           } >> "$GITHUB_OUTPUT"
 
+      # `appVersion` is what the image tags default to, so a stale one publishes
+      # a chart that silently installs an old Sim -- and because published chart
+      # versions are immutable, every stale value is frozen forever. It sat six
+      # releases behind before this check existed, bumped only by hand.
+      #
+      # Compares against the latest GitHub release rather than a hardcoded value
+      # so it cannot go stale itself. Prereleases and drafts are excluded: the
+      # `/releases/latest` endpoint already returns neither.
+      - name: appVersion tracks the latest app release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          app_version=$(helm show chart helm/sim | awk '/^appVersion:/ {print $2}' | tr -d '"')
+          latest=$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name)
+          if [ -z "$latest" ]; then
+            echo "::error::Could not resolve the latest release; refusing to publish unverified."
+            exit 1
+          fi
+          if [ "$app_version" != "$latest" ]; then
+            echo "::error::Chart.yaml appVersion is ${app_version} but the latest release is ${latest}. Bump appVersion (and the chart version) so the chart does not publish an install pinned to an older Sim."
+            exit 1
+          fi
+          echo "appVersion ${app_version} matches the latest release."
+
       # Chart versions are immutable once published: whoever pinned a version
       # must keep resolving the same bytes forever. The PR gate above already
       # forces a version bump on every chart change, so a version that is

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -311,7 +311,7 @@ Setting the variable to an empty string does **not** remove it: the chart reads
 Null the variable in every layer that sets it. If it appears in both `app.env` and `app.envDefaults`, nulling only the `app.env` entry lets the `envDefaults` value apply again and the limit stays in force. With External Secrets, also drop the key from `externalSecrets.remoteRefs.app`, which keeps syncing it independently. Confirm what the pod will actually receive before rolling out:
 
 ```bash
-helm template sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 -f values.yaml | grep -A1 FREE_TABLE   # expect no output
+helm template sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 -f values.yaml | grep -A1 FREE_TABLE   # expect no output
 ```
 
 `null` deletion has no effect under `helm upgrade --reuse-values` — pass your full values with `-f`, or use `--reset-then-reuse-values` (Helm 3.14+). If you deploy with Argo CD, put the `null` in `valueFiles` or the `values` string rather than `valuesObject`, which strips nulls. On Docker Compose, delete the line from your `.env` file.

apps/docs/content/docs/platform/self-hosting/kubernetes.mdx

@@ -40,7 +40,7 @@ POSTGRES_PASSWORD=$(openssl rand -hex 24)
 
 # Install
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
   --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
@@ -70,7 +70,7 @@ For clusters or GitOps configs that consume `helm repo add` rather than OCI:
 helm repo add sim https://charts.sim.ai
 helm repo update
 
-helm install sim sim/sim --version 1.9.4 --namespace simstudio --create-namespace \
+helm install sim sim/sim --version 1.9.5 --namespace simstudio --create-namespace \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
   --set app.env.INTERNAL_API_SECRET="$INTERNAL_API_SECRET" \
@@ -87,11 +87,11 @@ apply to the OCI artifact only.
 Every published version is signed with Sigstore keyless signing and carries a SLSA build-provenance attestation. Both live in the registry alongside the chart, so they survive a mirror into an internal registry.
 
 ```bash
-cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.4 \
+cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.5 \
   --certificate-identity-regexp '^https://github.com/simstudioai/sim/' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
 
-gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.4 --repo simstudioai/sim
+gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.5 --repo simstudioai/sim
 ```
 
 Signing is Sigstore-only — there is no GPG `.prov` file, so `helm install --verify` does not apply.
@@ -112,7 +112,7 @@ SIM_RELEASE=v0.8.24
 curl -fsSLO "https://raw.githubusercontent.com/simstudioai/sim/$SIM_RELEASE/helm/sim/examples/values-aws.yaml"
 
 helm upgrade --install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --values values-aws.yaml \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
@@ -233,7 +233,7 @@ kubectl port-forward deployment/sim-app 3000:3000 -n simstudio
 kubectl logs -l app.kubernetes.io/component=app -n simstudio --tail=100
 
 # Upgrade (always pin the target chart version)
-helm upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 --namespace simstudio
+helm upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 --namespace simstudio
 
 # Uninstall
 helm uninstall sim --namespace simstudio

apps/docs/content/docs/platform/self-hosting/reference-architectures.mdx

@@ -152,7 +152,7 @@ resource "helm_release" "sim" {
   # release with new migrations.
   repository = "oci://ghcr.io/simstudioai/charts"
   chart      = "sim"
-  version    = "1.9.4"
+  version    = "1.9.5"
 
   # Or the classic repository, if your tooling does not speak OCI:
   #   repository = "https://charts.sim.ai"

apps/docs/content/docs/platform/self-hosting/upgrades.mdx

@@ -157,15 +157,15 @@ Migration surprises are usually data-shaped rather than schema-shaped, so a stag
 
 ```bash
 helm upgrade sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --namespace simstudio \
   --values my-values.yaml
 ```
 
 Preview first if the chart version changed:
 
 ```bash
-helm diff upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 -n simstudio --values my-values.yaml
+helm diff upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 -n simstudio --values my-values.yaml
 ```
 
 Then watch the rollout:

helm/sim/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.9.4
-appVersion: "v0.8.18"
+version: 1.9.5
+appVersion: "v0.8.24"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai
 icon: https://raw.githubusercontent.com/simstudioai/sim/main/apps/sim/public/logo/primary/primary.svg

helm/sim/README.md

@@ -23,7 +23,7 @@ export POSTGRES_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=')
 
 # Install from the registry
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --namespace sim --create-namespace \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
@@ -107,10 +107,10 @@ immutable once published.
 
 ```bash
 # List the published versions
-helm show chart oci://ghcr.io/simstudioai/charts/sim --version 1.9.4
+helm show chart oci://ghcr.io/simstudioai/charts/sim --version 1.9.5
 
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --namespace sim --create-namespace \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
@@ -127,8 +127,8 @@ To mirror the chart into an internal registry — the usual requirement for an
 air-gapped or internal-only cluster:
 
 ```bash
-helm pull oci://ghcr.io/simstudioai/charts/sim --version 1.9.4
-helm push sim-1.9.4.tgz oci://registry.internal.example.com/charts
+helm pull oci://ghcr.io/simstudioai/charts/sim --version 1.9.5
+helm push sim-1.9.5.tgz oci://registry.internal.example.com/charts
 ```
 
 The container images the chart references are listed in
@@ -144,7 +144,7 @@ helm repo add sim https://charts.sim.ai
 helm repo update
 
 helm install sim sim/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --namespace sim --create-namespace \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
   --set app.env.ENCRYPTION_KEY="$ENCRYPTION_KEY" \
@@ -177,18 +177,18 @@ otherwise identical.
 
 ```bash
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --namespace sim --create-namespace \
   --values my-values.yaml
 ```
 
-Run `helm template oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 --values my-values.yaml | less` first to
+Run `helm template oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 --values my-values.yaml | less` first to
 see what will be applied.
 
 ### Validate the install
 
 ```bash
-helm install sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 --dry-run --debug \
+helm install sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 --dry-run --debug \
   --values my-values.yaml \
   --set app.env.BETTER_AUTH_SECRET=$(openssl rand -hex 16) \
   --set app.env.ENCRYPTION_KEY=$(openssl rand -hex 16) \
@@ -207,12 +207,12 @@ the registry next to the chart so they survive a mirror.
 
 ```bash
 # The signature: proves this chart was signed by a GitHub Actions run in this repo
-cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.4 \
+cosign verify oci://ghcr.io/simstudioai/charts/sim:1.9.5 \
   --certificate-identity-regexp '^https://github.com/simstudioai/sim/' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
 
 # The provenance: proves which workflow, commit, and runner produced it
-gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.4 --repo simstudioai/sim
+gh attestation verify oci://ghcr.io/simstudioai/charts/sim:1.9.5 --repo simstudioai/sim
 ```
 
 There is no GPG `.prov` file — signing is Sigstore-only, so there is no
@@ -224,7 +224,7 @@ GPG provenance format and will not work; use `cosign verify` above.
 ## Upgrading
 
 ```bash
-helm upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 --namespace sim --values my-values.yaml
+helm upgrade sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 --namespace sim --values my-values.yaml
 ```
 
 ---
@@ -276,7 +276,7 @@ SIM_RELEASE=v0.8.24
 curl -fsSLO "https://raw.githubusercontent.com/simstudioai/sim/$SIM_RELEASE/helm/sim/examples/values-production.yaml"
 
 helm install sim oci://ghcr.io/simstudioai/charts/sim \
-  --version 1.9.4 \
+  --version 1.9.5 \
   --namespace sim --create-namespace \
   --values values-production.yaml \
   --set app.env.BETTER_AUTH_SECRET="$BETTER_AUTH_SECRET" \
@@ -293,7 +293,7 @@ This chart is intentionally configurable. Rather than maintain a hand-curated pa
 
 ```bash
 # Print all values with comments and defaults
-helm show values oci://ghcr.io/simstudioai/charts/sim --version 1.9.4
+helm show values oci://ghcr.io/simstudioai/charts/sim --version 1.9.5
 ```
 
 The JSON Schema that `helm install` validates your values against ships inside
@@ -353,7 +353,7 @@ The chart supports three ways to provide secrets, in increasing order of product
 ### 1. Inline `--set` (dev / dry-run only)
 
 ```bash
-helm install sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 --set app.env.BETTER_AUTH_SECRET=...
+helm install sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 --set app.env.BETTER_AUTH_SECRET=...
 ```
 
 Discouraged for production — values land in `helm get values` output.
@@ -484,7 +484,7 @@ With the chart-managed Secret (the default), nulling a key the application canno
 The common case is a free-tier cap inherited from a chart release older than the one that stopped presetting them, which shipped `FREE_TABLES_LIMIT: "3"` and `FREE_TABLE_ROWS_LIMIT: "1000"` under `app.envDefaults`. With billing disabled, Sim reads an unset limit as unlimited, so nulling these lifts the cap. Verify before rolling out:
 
 ```bash
-helm template sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 -f values.yaml | grep -A1 FREE_TABLE   # expect no output
+helm template sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 -f values.yaml | grep -A1 FREE_TABLE   # expect no output
 ```
 
 ---
@@ -552,7 +552,7 @@ Without a cluster-reachable `INTERNAL_API_BASE_URL` (it falls back to `NEXT_PUBL
 You ran `helm install` without setting required secrets. Generate them and pass with `--set`:
 
 ```bash
-helm install sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.4 \
+helm install sim oci://ghcr.io/simstudioai/charts/sim --version 1.9.5 \
   --set app.env.BETTER_AUTH_SECRET=$(openssl rand -hex 32) \
   --set app.env.ENCRYPTION_KEY=$(openssl rand -hex 32) \
   --set app.env.INTERNAL_API_SECRET=$(openssl rand -hex 32) \

helm/sim/images.yaml

@@ -22,22 +22,22 @@
 # render it twice. That override also CHANGES where the chart pulls from, to
 # `<your-registry>/nvidia/k8s-device-plugin` — mirror the device plugin there
 # instead of to the `mirror` path listed below, or the pull fails.
-appVersion: v0.8.18
+appVersion: v0.8.24
 images:
   - source: busybox:1.36
     mirror: busybox:1.36
   - source: curlimages/curl:8.5.0
     mirror: curlimages/curl:8.5.0
-  - source: ghcr.io/simstudioai/copilot:v0.8.18
-    mirror: simstudioai/copilot:v0.8.18
-  - source: ghcr.io/simstudioai/migrations:v0.8.18
-    mirror: simstudioai/migrations:v0.8.18
-  - source: ghcr.io/simstudioai/pii:v0.8.18
-    mirror: simstudioai/pii:v0.8.18
-  - source: ghcr.io/simstudioai/realtime:v0.8.18
-    mirror: simstudioai/realtime:v0.8.18
-  - source: ghcr.io/simstudioai/simstudio:v0.8.18
-    mirror: simstudioai/simstudio:v0.8.18
+  - source: ghcr.io/simstudioai/copilot:v0.8.24
+    mirror: simstudioai/copilot:v0.8.24
+  - source: ghcr.io/simstudioai/migrations:v0.8.24
+    mirror: simstudioai/migrations:v0.8.24
+  - source: ghcr.io/simstudioai/pii:v0.8.24
+    mirror: simstudioai/pii:v0.8.24
+  - source: ghcr.io/simstudioai/realtime:v0.8.24
+    mirror: simstudioai/realtime:v0.8.24
+  - source: ghcr.io/simstudioai/simstudio:v0.8.24
+    mirror: simstudioai/simstudio:v0.8.24
   - source: nvcr.io/nvidia/k8s-device-plugin:v0.18.2
     mirror: nvcr.io/nvidia/k8s-device-plugin:v0.18.2
   - source: ollama/ollama:0.23.2