chore: update-images script; orchestrator 2.2.3, Redis 7.4.11, ClickHouse 26.4.5

[levivannoort]

What

make update-images (hack/update-images.sh) bumps the pinned image tags in values.yaml to the newest tag in each registry (Docker Hub, GHCR, Quay; anonymous), then syncs artifacthub.io/images. A local stand-in until Renovate is enabled.

• A candidate has the same shape as the current tag (7.4.7-alpine → 7.4.x-alpine, 1.1.159-self-hosted, v0.20.1), so latest, 7, 7.4 and -rc tags are never picked.
• Built-in datastores keep their major version (as in renovate.json); ClickHouse keeps its year.month release (26.4.x), since 26.4 → 26.9 is five feature releases.
• The images renovate.json groups with Appwrite (console, executor, orchestrator, geo, browser, assistant, embedding, autogravity, appwrite/postgres) should match Appwrite's docker-compose.yml for appVersion, not the newest tag: they're skipped unless --all.
• --dry-run lists without changing anything. Edits only the tag: lines: yq -i would drop every blank line in values.yaml.

Bumps, each checked against Appwrite 2.3.0's docker-compose.yml, which matches every other pin in the chart:

Image	From → to	Why
orchestrator jobs-service, job-sidecar	2.2.2 → 2.2.3	v2.2.3 only fixes the Kubernetes backend the chart uses for builds ("let the post sidecar read owner-only worker output"). Compose stays on 2.2.2 because it runs the Docker backend.
redis	7.4.7-alpine → 7.4.11-alpine	patch releases of the version Appwrite pins
clickhouse-server	26.4.3-alpine → 26.4.5-alpine	patch releases of the version Appwrite pins

Not bumped, from --dry-run --all: executor 1.1.2 (only on Appwrite main; 2.4.0 still ships 0.29.0), console 1.2.x (2.4.0's), appwrite/postgres 0.2.0 (no Appwrite release uses it), geo/browser/embedding (go with the 2.4.0 upgrade).

skip-changelog: nothing has been published yet. #16 is merged but 1.0.0 isn't published (the repository is still private), and the release publishes main as it is when it runs. Merge this before the release runs and 1.0.0 ships with these versions. If 1.0.0 is published first, this needs an [Unreleased] entry instead.

Testing

• make test passes locally (236/236 unit tests, kubeconform on every scenario, generated files up to date); shellcheck clean.
• hack/update-images.sh run in a scratch worktree: only tag: lines change, hack/chart-images.sh --check passes, a second run finds nothing to update.
• Not run: the kind installs, which wait for Actions (see chore(release): appwrite 1.0.0 #16).

Checklist

• make test passes locally
• make generate was run and the generated files are committed
• Unit tests added or updated (builds_test.yaml asserts the orchestrator image)
• Guides in docs/ and files in examples/ updated for changes to how the chart is configured (no configuration changes; hack/fixtures/external-dbs.yaml follows the new Redis and ClickHouse versions)
• skip-changelog: unreleased
• Renamed or removed values go through Deprecating a value (none)

[hansi-codes]

🔵 Tier A · Mergeable after minor fixes

The values query can fail without failing the helper, so that error needs to propagate before the change is ready to merge.

Adds make update-images and a registry-tag updater that can preview or apply matching image-tag updates, then syncs the Artifact Hub image annotation. The chart defaults, generated README, orchestrator image test, and external-database fixtures are updated for the Redis, ClickHouse, and orchestrator patch releases.

Verdict	New comments	Fixed	Still open
💬 Commented	1	0	0

Note

Not approving while a bug finding is open: Propagate failures from the values query

	Finding	Where
🟡	Propagate failures from the values query	hack/update-images.sh:109

Fix with agent prompt

### Issue 1
hack/update-images.sh:109-110
**Propagate failures from the values query**

The `yq` command runs in process substitution, so its exit status is not covered by `set -e` or the `while` loop's status. If `yq` is missing or `values.yaml` cannot be parsed, the helper can print an error and still exit successfully, making a failed update look like a successful no-op.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

📂 Walkthrough · 7

File	Change
Makefile	Adds the update-images Make target.
charts/appwrite/Chart.yaml	Updates the Artifact Hub image pins for Redis, ClickHouse, and the orchestrator.
charts/appwrite/README.md	Refreshes generated default image tags.
charts/appwrite/tests/builds_test.yaml	Asserts the updated orchestrator and job-sidecar images.
charts/appwrite/values.yaml	Updates the Redis, ClickHouse, and orchestrator image defaults.
hack/fixtures/external-dbs.yaml	Updates the Redis and ClickHouse fixture image tags.
hack/update-images.sh	Adds a script to find newer matching registry tags and optionally apply them.

---

_{Reviewed 9cadabd · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · Looks good to merge. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary

[hansi-codes]

🔵 Tier A · See the inline comments. Summary

[hansi-codes]

Propagate failures from the values query

The yq command runs in process substitution, so its exit status is not covered by set -e or the while loop's status. If yq is missing or values.yaml cannot be parsed, the helper can print an error and still exit successfully, making a failed update look like a successful no-op.

Prompt To Fix With AI

This is a comment left during a code review.
Path: hack/update-images.sh
Line: 109-110

Comment:
**Propagate failures from the values query**

The `yq` command runs in process substitution, so its exit status is not covered by `set -e` or the `while` loop's status. If `yq` is missing or `values.yaml` cannot be parsed, the helper can print an error and still exit successfully, making a failed update look like a successful no-op.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{🟡 Minor · error-handling · Reply if this doesn't apply.}