You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(workflows): add chart-only mode to shared-release and three new release workflows - #69
shared-release.yaml: adds chart-only boolean input (default: false). When true: skips appVersion bump, tags as helm-chart-vX.Y.Z instead of vX.Y.Z, skips GitHub Release creation. Fully backward compatible — existing callers pass no new inputs.
shared-helm-release.yaml(new): reusable helm package + helm push to GHCR OCI. Includes a duplicate-version guard that fails fast; set allow-existing: true to exit 0 instead (useful when not all charts in a batch have changed).
shared-docker-release.yaml(new): reusable Docker build + multi-arch push to GHCR. Standard tag set: semver, v{major}.{minor}, v{major}, latest (default branch only), long sha.
These workflows are the foundation for consolidating the release processes across the org. Each downstream repo will replace its bespoke release workflows with callers of these shared ones, eliminating 4 copies of helm publish logic, 2 copies of goreleaser logic, and providing a common docker release pattern.
Design decisions
All OCI helm pushes use the repo-scoped pathoci://ghcr.io/{repo}/charts/ (not owner-scoped).
latest Docker tag is only applied on the default branch to prevent pre-release tags from overwriting it.
shared-goreleaser.yaml deliberately excludes repo-specific changelog builder steps — GoReleaser handles release notes via its own config.
All action versions match the pinned SHAs already in use across this repo.
Test plan
Verify shared-release.yaml with chart-only: true creates a helm-chart-v* tag, skips appVersion, skips GitHub Release
Verify shared-release.yaml with chart-only: false (default) has identical behaviour to before this change
Review YAML structure of the three new workflows for correctness
After a chart-only release, a normal release with both makefile-path and chart-path can reuse a published chart version. Starting at 1.2.3, a chart-only patch publishes chart 1.2.4 while leaving the Makefile at 1.2.3. The next app patch derives 1.2.4 from the Makefile and writes it to the chart with a new appVersion. The Helm duplicate guard then rejects publication, or skips it with allow-existing, leaving the updated chart unpublished. Advance the chart version independently during app releases, while keeping appVersion tied to the application version.
…kflows
- shared-docker-release: add flavor:latest=false so metadata-action does not
auto-tag semver releases as latest; only the explicit type=raw rule controls it
- shared-goreleaser: scope concurrency group to goreleaser+repo+ref to prevent
helm/version-bump jobs from displacing pending goreleaser runs
- shared-helm-release: scope concurrency group to helm+repo+chart+ref so
independent chart releases do not cancel each other
- shared-helm-release: use helm show chart for version extraction instead of
raw YAML grep/sed to handle quoted and commented version fields correctly
- shared-release: reject makefile-path when chart-only=true to prevent version
mismatch between Makefile and Chart.yaml in chart-only mode; require chart-path
Signed-off-by: I313226 <I313226@users.noreply.github.com>
…pipelines
- Add warning that GITHUB_TOKEN tag pushes do not trigger downstream
push workflows; PAT or GitHub App token required for automatic chaining
- Restructure complete example into two independent pipelines: app release
(v* tags) and chart release (helm-chart-* tags) to avoid implying a
single v* tag triggers chart publishing
Signed-off-by: I313226 <I313226@users.noreply.github.com>
…cker tag
- shared-helm-release: distinguish 'version not found' from real errors
(auth/network/transport) in the duplicate-version check; previously all
non-zero helm pull exits were treated as 'not found', so a transient
failure could silently proceed to push and overwrite an existing chart
- shared-docker-release: add type=semver,pattern=v{{version}} alias so
both unprefixed (0.6.0) and v-prefixed (v0.6.0) tags are always
published; charts that default image tag to .Chart.AppVersion (v-prefixed)
would otherwise reference an unpublished tag
Signed-off-by: I313226 <I313226@users.noreply.github.com>
Normalize repository names in OCI pull and push references
.github/workflows/shared-helm-release.yaml:106
For callers such as cloudoperators/MyApp, github.repository retains uppercase characters, which are invalid in OCI repository paths. The duplicate check therefore fails before publishing. Normalize the repository component in both this pull reference and the push destination at line 138, for example by replacing ${{ github.repository }} with ${GITHUB_REPOSITORY,,} in both shell commands. Fixing only the pull reference leaves publishing broken.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
shared-release.yaml: addschart-onlyboolean input (default:false). Whentrue: skipsappVersionbump, tags ashelm-chart-vX.Y.Zinstead ofvX.Y.Z, skips GitHub Release creation. Fully backward compatible — existing callers pass no new inputs.shared-helm-release.yaml(new): reusablehelm package+helm pushto GHCR OCI. Includes a duplicate-version guard that fails fast; setallow-existing: trueto exit 0 instead (useful when not all charts in a batch have changed).shared-docker-release.yaml(new): reusable Docker build + multi-arch push to GHCR. Standard tag set: semver,v{major}.{minor},v{major},latest(default branch only), long sha.shared-goreleaser.yaml(new): reusable GoReleaser binary build + GitHub Release. Supports optionalgoreleaser-configpath andgoreleaser-versionconstraint.Context
These workflows are the foundation for consolidating the release processes across the org. Each downstream repo will replace its bespoke release workflows with callers of these shared ones, eliminating 4 copies of helm publish logic, 2 copies of goreleaser logic, and providing a common docker release pattern.
Design decisions
oci://ghcr.io/{repo}/charts/(not owner-scoped).latestDocker tag is only applied on the default branch to prevent pre-release tags from overwriting it.shared-goreleaser.yamldeliberately excludes repo-specific changelog builder steps — GoReleaser handles release notes via its own config.Test plan
shared-release.yamlwithchart-only: truecreates ahelm-chart-v*tag, skipsappVersion, skips GitHub Releaseshared-release.yamlwithchart-only: false(default) has identical behaviour to before this change