build: bump nebi to v0.15 (sha-5ca877a) (#240)

Update the default nebi.image.tag to the v0.15 tag commit and bring the
Dockerfile fallback NEBI_VERSION in line so the baked binary matches the
init-container version.

Author: tylerpotts

docs/src/content/docs/nebi-integration.md

@@ -70,7 +70,7 @@ That means the Nebi version is a deploy-time decision:
 nebi:
   image:
     repository: quay.io/nebari/nebi
-    tag: "sha-bd25921"
+    tag: "sha-5ca877a"
     pullPolicy: IfNotPresent
 ```
 

docs/src/content/docs/values-reference.md

@@ -142,7 +142,7 @@ Admin guide: [Nebi integration](/nebi-integration/).
 | Field | Default | What it does |
 |---|---|---|
 | `nebi.image.repository` | `quay.io/nebari/nebi` | Binary copied into user pods by an init container. |
-| `nebi.image.tag` | `sha-bd25921` | Pinned per chart release. Empty disables the init container. |
+| `nebi.image.tag` | `sha-5ca877a` | Pinned per chart release. Empty disables the init container. |
 | `nebi.image.pullPolicy` | `IfNotPresent` | — |
 | `nebi.remoteURL` | `""` *(derived)* | Browser-facing Nebi URL, used for the OIDC redirect. |
 | `nebi.internalURL` | `""` *(derived)* | In-cluster URL for the token-exchange path. |

images/Dockerfile

@@ -113,7 +113,7 @@ FROM ${NEBI_IMAGE:-scratch} AS nebi-source
 # ========== jupyterlab (base + nebi) ===========
 FROM jupyterlab-base AS jupyterlab
 
-ARG NEBI_VERSION=0.12-rc3
+ARG NEBI_VERSION=0.15
 ARG TARGETARCH
 
 # Install nebi: copy from NEBI_IMAGE if provided, else download from GitHub release.

values.yaml

@@ -252,8 +252,8 @@ nebi:
     # Pinned manually per chart release (scripts/bump_image_tags.py only
     # handles the jupyterlab images); deployers can override to test a PR
     # build or roll forward. Leave non-empty so the init container is wired
-    # by default. sha-bd25921 == the nebi v0.14 tag commit.
-    tag: "sha-bd25921"
+    # by default. sha-5ca877a == the nebi v0.15 tag commit.
+    tag: "sha-5ca877a"
     pullPolicy: IfNotPresent
   # External Nebi FQDN (browser-side, used for OIDC redirect).
   # If empty, derived from keycloak.hostname as