fix(chart): claimer falls through to image.tag when its own tag is unset

[lucasmundim]

Summary

Hoists the load-bearing piece of #62 (DT-164) so the drift hole closes before gitops#130 (ArgoCD Image Updater) reconciles in clusters.

The bug

On current main, deployment/openfilter-pipelines-controller/overrides/{development,lab,staging,production}.yaml carries:

image:
  tag: "<sha>" # {"$imagepolicy": "<env>:openfilter-pipelines-controller:tag"}
claimerImage:
  tag: "<sha>" # {"$imagepolicy": "<env>:openfilter-pipelines-controller:tag"}

Today image-policy-applier writes both tag: values from the same source-of-truth and they advance together. Once gitops#130 lands, ArgoCD Image Updater takes over and only rewrites image.tag — its image-list annotation covers openfilter-pipelines-controller, not the claimer. claimerImage.tag would freeze at whatever SHA it was last set to while the controller advances, silently drifting until a claimer-side flag or API change makes the gap user-visible (in prod, that means "the claimer is on a stale binary and you don't know it until something breaks").

Fix

• templates/deployment.yaml:121 — CLAIMER_IMAGE rendering gains a default .Values.image.tag fallback so the claimer's tag follows the controller's whenever its own is unset. Chart.AppVersion stays as the last-resort floor for fresh installs (same as before).
• The four overrides drop the static claimerImage.tag: <sha> line + $imagepolicy marker. claimerImage.repository: plainsightai/openfilter-pipelines-claimer stays — that's the post-feat(deploy): unify image + chart publishing under Docker Hub OCI #71 Docker Hub path. With no tag: set, the template's fallback chain takes over.

Same shape as the fix bundled in #62, lifted to its own PR so it can land independently of #62's broader workflow refactor (which currently conflicts with #71's docker-publish.yml and needs a rebase regardless).

Validation

$ helm template test deployment/openfilter-pipelines-controller \
    -f deployment/openfilter-pipelines-controller/overrides/production.yaml \
    | grep -A1 CLAIMER_IMAGE
            - name: CLAIMER_IMAGE
              value: "plainsightai/openfilter-pipelines-claimer:fe613cc832bc53753274fb6e1a178dd8d00d2c33"

(image.tag's value flowing through to the claimer as expected.)

• helm lint clean
• helm template against production override renders the post-fallback value correctly

Cross-refs

• feat(deploy): unify image + chart publishing under Docker Hub OCI #71 — Docker Hub publish that introduced the drift hole (changed which tag field Image Updater would target).
• feat(deploy): refactor deployments workflow to remove direct gitops pushing (DT-164) #62 — Sam's larger DT-164 refactor that originally bundled this fix. Cherry-picking the load-bearing bits here so the hole closes before gitops#130's rollout independent of feat(deploy): refactor deployments workflow to remove direct gitops pushing (DT-164) #62's rebase.
• gitops#130 — the Image Updater configuration this guards against.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[leandrobmarinho]

Verified by rendering the chart across scenarios: with claimerImage.tag unset, CLAIMER_IMAGE correctly falls through to image.tag and then Chart.AppVersion, keeping controller and claimer in lockstep under ArgoCD Image Updater; removing the redundant claimerImage.tag overrides also drops a duplicate imagepolicy annotation that would otherwise drift. Looks good.

[shingonoide]

APPROVE.

The claimer image tag now falls through to the controller's image.tag before the chart appVersion, which is exactly what's needed once ArgoCD Image Updater rewrites only image.tag.

Confirmed the new expression in templates/deployment.yaml is {{ .Values.claimerImage.tag | default .Values.image.tag | default .Chart.AppVersion }}. Helm's default treats an empty string as falsy, so an unset or empty claimerImage.tag correctly inherits image.tag, and a bare install with both empty still resolves to the chart appVersion (0.5.1), so no empty or latest tag ever renders. The controller image line is untouched and stays the single field Image Updater targets. All four environment overrides drop their static claimerImage.tag while keeping the repository, and no other template references the claimer tag, so nothing inconsistent is left behind. CI is green.

One optional, non-blocking nit: README.md and the values.yaml comment for claimerImage.tag still say it "defaults to chart appVersion". With this change it defaults to image.tag first and only then to appVersion, so a one-line doc tweak would keep them accurate. Fine to fold into a later pass.

Clean, well-scoped change.