[Kevin Cho (chokevin)]

Summary

The install help's disable-Portal example used a value the umbrella chart ignores, while chart publication could succeed before its required runtime images were available. The example now uses the subchart key, and publication verifies all candidate archives' rendered images before pushing any chart.

• Use taugrid-core.portal.enabled=false in help and document the setting. The plan explicitly lists defaults before Helm overrides; readiness checks enabled components and skips disabled ones.
• Render candidate chart archives and verify container, init-container, sidecar and hook image references in their consumer registries. A missing image, invalid reference, registry error or render failure prevents publication.
• Preserve existing chart versions, default component enablement and existing-version skips. Add a read-only verify-images command and focused publisher regressions.

Review the all-candidate verification before the first push in scripts/ci/publish-helm-charts.sh, then the executable help regression in cli/internal/cli/cluster_install_test.go.

Related issue

Closes #528.

Relates to #527. This prevents recurrence but does not publish the missing 0.4.8 Portal image or resolve the current installation failure. Recovery remains a separate authorized release operation.

Validation

Passed locally on macOS with Helm 4.2.0:

cd cli && go test ./internal/cli ./internal/installationcheck -count=1
Passed.

cd cli && go vet ./internal/cli ./internal/installationcheck
Passed.

helm unittest charts/taugrid -f 'tests/portal_default_test.yaml'
Passed: 8 tests.

bash scripts/ci/tests/publish-helm-charts_test.sh
Passed: real Helm/yq fixtures with mocked registry operations; missing main/init/sidecar/hook images, render failures, malformed references and all-before-push behavior.

shellcheck scripts/ci/publish-helm-charts.sh scripts/ci/tests/publish-helm-charts_test.sh
Passed.

python3 site/scripts/check_content.py site/content/en/docs
Passed: 35 capability pages.

python3 scripts/check-license-headers.py
Passed: 914 source files.

git diff --check
Passed.

The new CLI regression failed on the old example before the fix. Actual umbrella renders retained one Portal image reference with portal.enabled=false and zero with taugrid-core.portal.enabled=false. Read-only verification of the released 0.4.8 archive rejected the missing Portal image.

No cluster installation, image publication or privileged chart push was performed. Live release recovery is not claimed.

Compatibility and operational impact

No public API, CRD, chart version, image tag or component-default changes. The plan describes chart defaults rather than claiming they are resolved overrides.

Chart publication now requires Helm, yq and Docker Buildx plus read access to required consumer image registries. The pipeline checks these tools before packaging. Any unavailable required image blocks all candidate chart pushes; restore the image or registry access rather than bypassing the gate. Disabled optional components and CRD schema examples are not treated as running images. Existing immutable chart versions remain skipped.

Checklist

• The change is focused and does not include unrelated edits.
• Tests cover the changed behavior, or I explained why tests are not needed.
• Documentation and examples are updated when public behavior changes.
• Generated files are updated from their source and included in this pull request.
• New dependencies are publicly available and their license and provenance were reviewed.
• The diff contains no secrets, private endpoints, customer data, or Microsoft-internal information.
• Fork-based CI can validate the change without repository secrets, or maintainer-only validation is clearly identified.

AI assistance: GitHub Copilot implemented the changes, ran the listed checks and drafted this description.

[Kevin Cho (chokevin)]

16-second evidence: the exact CLI change, actual umbrella-chart renders with the old and corrected settings, the all-candidate-before-push gate, and a controlled missing-image failure through the real verification script. Offline fixture only; no release publication or cluster execution.

install-release-evidence.mp4

[Kevin Cho (chokevin)]

Closing to consolidate release publication work around #532.