sync-versions.sh silently skips the Helm chart, shipping a stale agent image

The nvsnap Helm chart pins agent.image.tag: "v0.1.3" while scripts/versions.sh is at NVSNAP_APP_VERSION=v0.2.32. install-nvsnap.sh is the documented install path, so a fresh install deploys a 31-version-old agent. Found while validating on nvcf-dgxc-k8s-aws-usw2-dev2; test-e2e.sh refused to run with:

[ERROR] Deployed agent (.../nvsnap-agent:v0.1.3) != expected (.../nvsnap-agent:v0.2.32)

Root cause

scripts/sync-versions.sh already targets the chart. DIRS=(deploy/k8s deploy) covers deploy/helm/nvsnap/values.yaml. The defect is the substitution pattern:

sed_re="s|[^[:space:]\"']*/${name}:[^[:space:]\"']*|${new}|g"

It matches a single-token image reference. deploy/k8s/** uses that form:

nvcr.io/0651155215864979/ncp-dev/nvsnap-agent:v0.2.32

The chart uses split fields, so there is no /nvsnap-agent: token anywhere in the file:

image:
  registry: ""
  repository: nvsnap-agent
  tag: "v0.1.3"

grep -cE "[^[:space:]\"']*/nvsnap-agent:" deploy/helm/nvsnap/values.yaml returns 0. The sed no-ops, and sync-versions.sh still prints Synced nvsnap-agent -> ...:v0.2.32, so it reports success.

The staleness check right below it uses the same <name>: anchor, so it also matches nothing in the chart and passes vacuously. Nothing catches the drift.

Impact

Only the agent tag has actually drifted today (server v0.0.31, blobstore v0.0.1, l2-wait v0.0.1 all still match). But nothing prevents any chart tag from drifting, and the misleading Synced output plus vacuous verify means it fails silently and indefinitely.

Fix direction

Teach sync-versions.sh to handle the split repository:/tag: form for chart values, and make the verify step fail when an image named in IMAGES appears in a targeted file with no matching version. A verify that can pass without finding anything is the part that let this sit.

Workaround

./scripts/install-nvsnap.sh --set agent.image.tag=v0.2.32