feat/cherry: pick to 16 (#252)

* fix(ci): capture stderr when parsing helm push output (#249)

`helm push` (3.16+) writes the human-readable "Pushed:" and "Digest:"
lines to stderr, so the existing `$(helm push ...)` only captured an
empty stdout and the awk that extracts the digest produced no match.
Redirect stderr into stdout for the command substitution so the
digest-parser sees the same output that's already visible in the
runner log. The follow-up `sha256:[a-f0-9]{64}` regex check still
guards against malformed input.

Surfaced when publishing chart/v0.16.0 to oci://ghcr.io/nvidia/nodewright/charts:
the push itself succeeded, but the subsequent attestation steps failed
because no digest was extracted.

Signed-off-by: Alex Yuskauskas <ayuskauskas@nvidia.com>

* fix(chart): agent container path pointing to skyhook not nodewright

---------

Signed-off-by: Alex Yuskauskas <ayuskauskas@nvidia.com>

Author: ayuskauskas

.github/workflows/release.yml

@@ -182,7 +182,9 @@ jobs:
 
           chart_repo="ghcr.io/nvidia/nodewright/charts"
           chart_subject="${chart_repo}/${CHART_NAME}"
-          push_output="$(helm push "dist/${CHART_NAME}-${CHART_VERSION}.tgz" "oci://${chart_repo}")"
+          # `helm push` writes "Pushed:" and "Digest:" to stderr (helm 3.16+),
+          # so capture both streams or awk sees an empty string.
+          push_output="$(helm push "dist/${CHART_NAME}-${CHART_VERSION}.tgz" "oci://${chart_repo}" 2>&1)"
           printf '%s\n' "${push_output}"
           chart_digest="$(awk '/^Digest:/ {print $2}' <<< "${push_output}")"
           if ! [[ "${chart_digest}" =~ ^sha256:[a-f0-9]{64}$ ]]; then

chart/values.yaml

@@ -88,7 +88,7 @@ controllerManager:
       digest: "sha256:3dfeda5d8fbfe7b6778bb92ad4437caa2e73c1670d54ae29e55ca7d0d5ef5408" # manifest list digest (multi-arch) on ghcr.io/nvidia/nodewright/operator:v0.16.0
     ## agentImage: is the image used for the agent container. This image is the default for this install, but can be overridden in the CR at package level.
     agent:
-      repository: ghcr.io/nvidia/skyhook/agent
+      repository: ghcr.io/nvidia/nodewright/agent
       tag: "v6.4.2"
       digest: "sha256:7cd80f5ef351266dc08c3979e802f9dc936a1ed9fd02e199233e7968a3a0de3e" # manifest list digest (multi-arch) on ghcr.io/nvidia/skyhook/agent:v6.4.2