From 9d5430db8143d963d3cccf5c5710c7e7e14127b8 Mon Sep 17 00:00:00 2001
From: ZDDC <caseywitt@proton.me>
Date: Mon, 4 May 2026 08:01:34 -0500
Subject: [PATCH] fix(ci): chart-bump script writes full 40-char SHA to
 appVersion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Forgejo's uploadpack.allowAnySHA1InWant only matches FULL SHAs —
the 7-char short SHA from build-label / versions.txt produces
"couldn't find remote ref ae75855" on `git fetch --depth=1 origin
<short-sha>` (and `git clone --branch <short-sha>` fails the same
way). The chart's downstream Dockerfile uses fetch-by-ref to handle
SHAs as well as named refs, but only full SHAs go through.

Resolve the short SHA to its full form via `git rev-parse` in
notify-chart-bump.sh before writing the chart's appVersion. The
runner has the full git history (actions/checkout@v4 fetch-depth: 0),
so rev-parse works locally; the chart's appVersion becomes the
canonical 40-char SHA, and the BMCD pipeline-dev / pipeline-prod
fetches succeed cleanly.

Manually re-bumped chart develop after this commit:
  appVersion: 0.0.16-beta-ae75855 → 0.0.16-beta-ae758550a855f6a9507df08075475cb87cb67086
---
 .forgejo/scripts/notify-chart-bump.sh | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.forgejo/scripts/notify-chart-bump.sh b/.forgejo/scripts/notify-chart-bump.sh
index b9a34ce..2720650 100755
--- a/.forgejo/scripts/notify-chart-bump.sh
+++ b/.forgejo/scripts/notify-chart-bump.sh
@@ -78,7 +78,20 @@ case "$CHANNEL" in
             cat "$VERSIONS_FILE" >&2
             exit 1
         fi
-        TARGET_VERSION="${NEXT_STABLE}-beta-${SHORT_SHA}"
+        # Expand the short SHA from versions.txt to its full 40-char
+        # form. The chart's downstream Dockerfile fetches the SHA via
+        # `git fetch --depth=1 origin <sha>` against Forgejo, and
+        # Forgejo's uploadpack.allowAnySHA1InWant only matches FULL
+        # SHAs — a 7-char abbreviation returns "couldn't find remote
+        # ref". Resolving here (where we have the full local clone
+        # via actions/checkout@v4 fetch-depth: 0) keeps the chart's
+        # downstream consumers free of git plumbing.
+        FULL_SHA=$(git rev-parse "$SHORT_SHA" 2>/dev/null)
+        if [ -z "$FULL_SHA" ]; then
+            echo "::error::could not resolve $SHORT_SHA to a full SHA via git rev-parse" >&2
+            exit 1
+        fi
+        TARGET_VERSION="${NEXT_STABLE}-beta-${FULL_SHA}"
         BRANCHES="develop"
         TRIGGER_DESC="ZDDC beta cut"
         TRAILER="Triggered by push to git.varasys.io/VARASYS/ZDDC main with embedded/* changes (a ./build beta cut). Bumps appVersion so the dev Docker image is tagged zddc:$TARGET_VERSION, ensuring kubelet pulls a fresh image on the next helm upgrade."