fix(mirror): enforce Helm render version floor

[yankay]

Summary

Enforce defaults.MirrorDefaultKubeVersion (1.33.0) as the Helm rendering floor during mirror discovery. Lower, prerelease, or invalid recipe versions now use the render-safe default.

Fixes: #2340
Related: #2336

Type of Change

• Bug fix

Component(s) Affected

• Other: mirror discovery (pkg/mirror, pkg/defaults)

Implementation Notes

Use strict semantic version ordering for the render floor so precision-aware matching cannot let major-only or prerelease versions bypass it. This only changes the Kubernetes capability version passed to offline Helm rendering; recipe validation constraints remain unchanged.

Testing

go test -race ./pkg/mirror/...
# 63 tests passed

golangci-lint run -c .golangci.yaml ./pkg/mirror/...
# 0 issues

Real CLI verification with Helm v4.2.4:

aicr mirror list --service eks --accelerator a100 --intent training --os ubuntu

The recipe resolves Kubernetes >= 1.30. Before the fix, discovery returned 32 images and the DRA component failed to render. After the fix, it returned 33 images and included:

registry.k8s.io/dra-driver-nvidia/dra-driver-nvidia-gpu:v0.4.1

make qualify reached the full race suite but root-only permission-negative tests failed because paths such as /nonexistent and read-only directories remain writable by root.

Risk Assessment

• Low - Isolated behavior with unit and real Helm coverage

Rollout notes: N/A

Checklist

• Affected race tests and lint checks pass
• Tests cover below, equal, above, major-only, prerelease, prefixed, and invalid versions
• Changes follow existing patterns
• Commits are cryptographically signed and DCO signed off

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Welcome to AICR, @yankay! Thanks for your first pull request.

Before review, please ensure:

• All commits are signed off per the DCO
• CI checks pass (tests, lint, security scan)
• The PR description explains the why behind your changes

A maintainer will review this soon.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 40b4dd05-7ad5-4ae5-8630-eff8267864ef

📥 Commits

Reviewing files that changed from the base of the PR and between 1c9fd57 and 4a42f88.

📒 Files selected for processing (2)

• pkg/mirror/discover.go
• pkg/mirror/discover_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

Mirror discovery now parses extracted Kubernetes constraints and applies MirrorDefaultKubeVersion as a Helm-rendering floor. Invalid or lower versions return the default version. Higher versions remain normalized and are returned. Documentation states that this floor does not change recipe constraint validation. Tests cover partial, prefixed, higher, lower, equal, and invalid versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 4a42f

This change enforces a safer minimum Kubernetes version for Helm rendering during mirror discovery. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: almaslennikov

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy issue #2340 by applying MirrorDefaultKubeVersion as the floor for constraint-derived rendering versions, preserving valid versions at or above the floor, and leaving recipe validat…
Out of Scope Changes check	✅ Passed	The documentation, implementation, and tests are directly related to enforcing the Kubernetes version floor for mirror discovery. No unrelated code changes are identified.
Description check	✅ Passed	The description clearly explains the Kubernetes render-version floor, affected mirror discovery behavior, testing, and risk.
Title check	✅ Passed	The title clearly and concisely describes the main change: enforcing a Helm render version floor during mirror discovery.

Full details: Linked Issues check

Explanation

The changes satisfy issue #2340 by applying MirrorDefaultKubeVersion as the floor for constraint-derived rendering versions, preserving valid versions at or above the floor, and leaving recipe validation constraints unchanged.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[mchmarny]

Approve: no findings against 93da42c. Exact-head GitHub Actions validation has not run because the first-contributor vetting gate is still awaiting approval; focused race tests, lint, diff checking, and coverage validation passed locally.