Align packaged Helm defaults with the release artifact matrix

[jdye64]

Description

Addresses the release-packaging mismatches tracked by Bug 6596068.

Release packaging now:

1. Sets the packaged chart's version, appVersion, and default service.image.tag to the requested release version. A 26.08-RC1 release therefore defaults to nrl-service:26.08-RC1, matching the image built and pushed by the same workflow.
2. Pins the optional Nemotron Parse Helm NIM to nvcr.io/nim/nvidia/nemotron-parse-v2.0:2.0.8-variant.
3. Pins the optional Omni caption Helm NIM to nvcr.io/nim/nvidia/nemotron-3-nano-omni-30b-a3b-reasoning:2.0.4-variant.
4. Fails packaging when an image lacks an explicit tag or uses a floating tag such as latest.
5. Writes a Markdown inventory of every packaged chart image into the workflow summary for both release entry points, so release qualification can compare the shipped artifact set with the test plan matrix.

Chart documentation and the published support matrix track both new image pins. Targeted YAML scalar edits preserve chart comments and formatting. The regression test now reads each NIM's repository and tag from inside its own values block, so a swapped Parse/Omni pin fails.

Scope notes

• These changes update the operator-managed Helm NIMs. The local in-process Parse implementation remains v1.2, because local v2.0 support needs a separately verified model repository/revision and request/output contract.
• nemo_retriever/dev/compose/service-mode.compose.yaml still defaults NIM_PARSE_TAG and NIM_CAPTION_TAG to the previous images. Those defaults are left alone here because the library's self-hosted Parse contract still resolves to nvidia/nemotron-parse-v1.2, so moving dev compose to the v2.0 NIM could break local service-mode runs.
• The answer_llm override example still uses nvcr.io/nim/nvidia/nemotron-3-nano:1.7.0-variant, which is a different NIM from the Omni caption SKU.

Validation

• python3 nemo_retriever/tests/test_helm_optional_nims_disabled_by_default.py (15 tests: nine source and docs assertions passed, six Helm-render tests skipped because Helm is unavailable here)
• python3 -m pytest ci/tests/test_release_helm_chart.py -q (7 passed)
• python3 -m mkdocs build --strict --config-file mkdocs.yml (passed)
• Packaged inventory assertion confirms Parse resolves to nemotron-parse-v2.0:2.0.8-variant and Omni to nemotron-3-nano-omni-30b-a3b-reasoning:2.0.4-variant, with every chart image pinned

Checklist

• I am familiar with the Contributing Guidelines.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

  

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[greptile-apps]

Greptile Summary

The PR aligns packaged Helm metadata and the default service image tag with the requested release version.

• Pins the optional Parse and Omni NIM images to their release-qualified variants.
• Validates packaged image tags and emits an image inventory in both release workflows.
• Updates Helm documentation, support-matrix entries, and regression coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
ci/scripts/release_helm_chart.py	Adds targeted YAML version updates, packaged-image tag validation, and Markdown inventory generation.
.github/workflows/perform-release.yml	Requests and publishes the packaged Helm image inventory in both release phases.
.github/workflows/release-helm.yml	Adds the packaged image inventory to the standalone Helm release artifact summary.
nemo_retriever/helm/values.yaml	Updates the optional Parse and Omni NIM repositories and tags to release-qualified versions.
ci/tests/test_release_helm_chart.py	Covers release metadata replacement, nested image collection, pinned-tag validation, and inventory rendering.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Release version] --> B[Package Helm chart]
  B --> C[Set chart version and appVersion]
  B --> D[Set default service image tag]
  B --> E[Collect image references]
  E --> F[Validate pinned tags]
  F --> G[Write image inventory]
  G --> H[Workflow summary]

Loading

_{Reviews (3): Last reviewed commit: "chore: merge upstream/main and resolve d..." | Re-trigger Greptile}

[greptile-apps]

Implicit release workflow permissions

This release workflow still relies on repository-level GITHUB_TOKEN defaults instead of declaring explicit least-privilege permissions. Changes to those defaults can silently grant this secret-bearing workflow broader access than it requires, making its effective security posture difficult to audit.

Rule Used: GitHub Actions workflows must include explicit 'pe... (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/release-helm.yml
Line: 67-73

Comment:
**Implicit release workflow permissions**

This release workflow still relies on repository-level `GITHUB_TOKEN` defaults instead of declaring explicit least-privilege permissions. Changes to those defaults can silently grant this secret-bearing workflow broader access than it requires, making its effective security posture difficult to audit.

**Rule Used:** GitHub Actions workflows must include explicit 'pe... ([source](.greptile))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!