feat(release): separate stack artifact inventories

[sbaum1994]

TL;DR

Give the self-managed, compute-plane, and observability stacks independent
release inventories, then merge those three peer inventories into the public
artifact catalog and generated manifest.

Why

The self-managed inventory previously rendered states from all three stack
trees. That made the control-plane release responsible for independently
versioned compute and observability dependencies. It also missed images passed
through controller arguments rather than normal Kubernetes image fields,
including the cert-manager ACME HTTP-01 solver.

What changed

• Added one release-inventory.yaml owned by each stack.
• Limited every inventory config to Helmfile states under its own stack tree.
• Added independent GitHub release assets for the self-managed, compute-plane,
  and observability stacks.
• Generalized release preflight and tagged inventory generation across all
  three stack tags.
• Updated docs sync to select and merge all three inventory assets. Explicit
  version flags can pin an exact compatible release set.
• Added validation for stack-to-plane ownership, missing inventories,
  duplicate releases, and conflicting cross-stack artifact versions.
• Removed compute-plane pin sources from self-managed catalog provenance.
• Added discovery for exact --*-image=<reference> arguments and coverage for
  cert-manager's ACME HTTP-01 solver image.
• Added cert-manager-acmesolver v1.20.2 to the generated manifest as optional
  with publication pending.
• Added the contributor, architecture, and distribution flow in
  deploy/stacks/INVENTORY.md.

Customer Release Notes

Each self-managed NVCF stack now publishes its own artifact inventory. The
generated manifest combines the selected control-plane, compute-plane, and
observability inventories and includes the optional cert-manager ACME HTTP-01
solver image.

Plan Summary

No Kubernetes runtime resources change. Release automation now creates these
independent assets:

• nvcf-self-managed-stack-inventory.json
• nvcf-compute-plane-stack-inventory.json
• nvcf-observability-stack-inventory.json

The documentation updater consumes all three as peers. No inventory config
references another stack's Helmfile state.

Architecture

We split ownership at the distributable boundary. Each stack directory owns
its Helmfile states, render profiles, and release-inventory.yaml. A stack tag
therefore produces one inventory containing only artifacts installed or
created by that stack.

The release workflow resolves those artifacts from the immutable tagged
source and publishes the inventory beside that stack's release. The three
stacks can release independently; the control-plane release no longer carries
compute-plane or observability state.

tools/docs-version-sync is the aggregation boundary. It downloads the three
peer inventories, verifies that each inventory contains only its assigned
plane, rejects incompatible duplicate artifacts, and updates the version
catalog. The catalog keeps public distribution locations and required or
optional classifications, while the released inventories remain the source of
truth for resolved versions and provenance. The manifest page is generated
from that combined catalog.

At this phase, the latest-release comparison stays warn-only. Locally generated
documentation must still match the checked-in catalog.

Release Sequence

sequenceDiagram
    actor Contributor
    participant Stack as Owning stack
    participant Release as Release workflow
    participant Assets as GitHub Releases
    participant Sync as docs-version-sync
    participant Catalog as Version catalog
    participant Manifest as Manifest page

    Contributor->>Stack: Update dependency and release-inventory.yaml
    Contributor->>Stack: Run stack, inventory, and docs checks

    loop Self-managed, compute-plane, and observability releases
        Release->>Stack: Check out immutable stack tag
        Release->>Stack: Render configured profiles
        Stack-->>Release: Return charts, images, and resources
        Release->>Release: Validate stack ownership and classifications
        Release->>Assets: Publish the stack inventory JSON
    end

    Sync->>Assets: Download all three inventory assets
    Assets-->>Sync: Return immutable release inventories
    Sync->>Sync: Validate planes and merge compatible artifacts
    Sync->>Catalog: Update versions, provenance, and release sources
    Sync->>Manifest: Generate customer-facing inventory blocks

Loading

Usage

Follow deploy/stacks/INVENTORY.md when adding, updating, or removing a stack
dependency. To update documentation from the latest three releases:

git fetch --tags origin
go run -C tools/docs-version-sync . --target main --update-catalog
go run -C tools/docs-version-sync . --target main

Use --stack-version, --compute-stack-version, and
--observability-stack-version to select exact versions.

Testing

• make -C deploy/stacks/self-managed test
• make -C deploy/stacks/nvcf-compute-plane test-local
• go test -C tools/docs-version-sync ./...
• go vet -C tools/docs-version-sync ./...
• python3 tools/ci/test-github-release.py
• python3 .cursor/hooks/validate-skill-fanout.py
• ./tools/ci/check-doc-version-sync
• ./tools/ci/check-docs (0 errors, 1 hidden warning)
• git diff --check

make -C deploy/stacks/observability test reaches the profile matrix but does
not complete under the macOS system Bash 3 because an existing empty array is
expanded under set -u in tests/profile-defaults.sh. The changed code does
not modify that script. Linux CI provides the required validation environment.

Notes

The latest-release comparison is expected to warn until all three new release
assets exist. Its CI step remains continue-on-error, so it stays non-blocking
as requested. Generated-document consistency remains blocking.

Anonymous access could not verify the public cert-manager-acmesolver mirror,
so its distribution remains Publication pending.

References

• Stack inventory contributor flow

Related Pull Requests

None.

Dependencies

No new third-party dependency or version change. This inventories the existing
cert-manager-acmesolver v1.20.2 runtime image. cert-manager license handling is
already present, and no NOTICE update is required.

For the Reviewer

Please focus on the three inventory ownership boundaries, release asset
registration, and the three-way catalog merge and conflict validation.

For QA

No separate cluster QA is required. Release and documentation CI provide the
relevant validation.

Issues

Relates to #1838

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-feat-self-managed-stack-inventory.docs.buildwithfern.com/nvcf