feat: require an explicit version for everything the modules deploy

[gdrojas]

⚠️ Read before bumping

Thirteen inputs lose their default and become required. Any stack that bumps to this release fails at plan with No value for required variable until it declares them. VERSIONS.md lists the current value of each.

Four were previously unpinnable and resolved at deploy time, so read your cluster rather than copying the table: cert_manager_version, prometheus_version, logging_controller_image_tag, and traffic_manager_version on eks.

This is typed feat: rather than feat!: because the repository temporarily blocks breaking-change markers. release-please will therefore cut a minor, and the changelog will not carry this warning — whoever writes the release notes has to add it by hand.

What changes

Every version these modules deploy loses its default and becomes required. A default is a version somebody else chose, and it is why a moving reference survived this long unnoticed: nobody had to look at it.

Thirteen inputs now have no default:

Module	Inputs	Was
base	nullplatform_base_helm_version, logging_controller_image_tag, control_plane_agent_image_tag	2.44.0, 1.6.0, 0.9.2
agent	nullplatform_agent_helm_version, agent_traffic_manager_tag, agent_repos_scope_tag, image_tag	2.37.0, new, new, already required
eks	traffic_manager_version	"latest"
aks, gke	traffic_manager_version	""
commons	cert_manager_version, prometheus_version	never wired / did not exist
service_definition	repository_branch	"main"

Each rejects an empty value and the well-known moving names. That guard cannot tell a mutable ref from a fixed one by name alone — a tag called beta or a branch called develop still passes — so it catches mistakes, not intent.

Two inputs were not pinnable at all

cert_manager_version was declared and never referenced: grep found one occurrence, its own declaration, and the helm_release had no version argument. prometheus had neither. Both tracked whatever their chart repository served while the README showed a number.

Also

agent_repos_scope is now the repository alone plus a required tag, and rejects an inline # so pasting the old value fails during plan rather than at clone time inside the pod. agent_repos_extra requires a pinned ref on every entry, covering scopes-* and services-* without enumerating them.

repository_ref_type moves to "tags" as a consequence rather than a decision: with a pinned ref required, "heads" would build refs/heads/v1.4.0, which does not exist.

Each variable carries an # example: comment with the current value, so the generated README shows something pasteable instead of your-variable-name — paired with nullplatform/actions-nullplatform#96.

The agent module had no outputs and no tests, so its rendered values could not be asserted on. It now exports rendered_values and agent_repos, matching nullplatform/base.

Migration

VERSIONS.md (added in the stacked PR) lists the current value of every input. The rule is to pin what you are already running — but four of these were previously unpinnable and resolved at deploy time, so read your cluster rather than copying the table: cert_manager_version, prometheus_version, logging_controller_image_tag, and traffic_manager_version on eks.

helm -n <ns> list -o json | jq -r '.[] | "\(.name)\t\(.chart)"'
kubectl -n nullplatform-tools get deploy \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.template.spec.containers[*].image}{"\n"}{end}'

Verification

133 tests, 0 failures. Assertions that described the old defaults were updated or removed: aks and gke had a check for "traffic_manager not present when unset", a state that no longer exists.