wehub-resource-sync
88 lines
3.4 KiB
YAML
88 lines
3.4 KiB
YAML
name: Publish Helm Chart
|
|
|
|
# Publishes the DeerFlow Helm chart as an OCI artifact to GHCR alongside the
|
|
# container images (see container.yaml). Triggers on the same `v*` tags.
|
|
#
|
|
# On pull requests touching the chart or config.example.yaml, `validate-chart`
|
|
# runs lint + template render + a config_version drift check (the chart's
|
|
# embedded config_version must not lag config.example.yaml) so a broken or
|
|
# stale chart fails the PR, not the release.
|
|
#
|
|
# Users then install with:
|
|
# helm install deer-flow oci://ghcr.io/${{ owner }}/deer-flow --version <ver>
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
pull_request:
|
|
paths:
|
|
- "deploy/helm/deer-flow/**"
|
|
- "config.example.yaml"
|
|
- ".github/workflows/chart.yaml"
|
|
- "scripts/check_config_version.sh"
|
|
|
|
jobs:
|
|
validate-chart:
|
|
# Runs on PRs and release tags: catch a broken render or a stale
|
|
# config_version before merge / publish. A broken chart published under a
|
|
# vX.Y.Z tag is an immutable OCI artifact (GHCR won't let you overwrite
|
|
# --version), so a regression must fail here, not on install.
|
|
if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
|
|
|
|
# ubuntu-latest ships with helm 3 preinstalled - no setup-helm action needed.
|
|
- name: Lint chart
|
|
run: helm lint deploy/helm/deer-flow
|
|
- name: Validate templates render
|
|
run: helm template deer-flow deploy/helm/deer-flow --include-crds >/dev/null
|
|
|
|
# The chart's `config:` block embeds a config_version that must not fall
|
|
# behind config.example.yaml. A stale version is silent in-cluster (the
|
|
# image ships no example to compare against, so _check_config_version
|
|
# never warns) but means the chart's config is authored against an older
|
|
# schema. Bump it in values.yaml and the README example. config_version
|
|
# gates no runtime behavior - it only drives the outdated-warning - so a
|
|
# bare version bump needs no field changes. Logic lives in
|
|
# scripts/check_config_version.sh (shared with nightly.yaml).
|
|
- name: config_version drift check
|
|
run: bash scripts/check_config_version.sh
|
|
|
|
verify-versions:
|
|
# Gate the release: every version source must match the v* tag. A forgotten
|
|
# bump in Chart.yaml, pyproject.toml, or package.json fails here and skips
|
|
# the publish. See scripts/verify_versions.sh.
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: ./.github/workflows/verify-versions.yml
|
|
|
|
publish-chart:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
needs: [verify-versions, validate-chart]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
|
|
|
|
- name: Log in to GHCR
|
|
run: |
|
|
echo "${{ secrets.GITHUB_TOKEN }}" | \
|
|
helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
|
|
|
|
- name: Package chart
|
|
run: helm package deploy/helm/deer-flow --destination ./packages
|
|
|
|
- name: Push chart to GHCR
|
|
run: |
|
|
for pkg in ./packages/*.tgz; do
|
|
echo "--- pushing $pkg"
|
|
helm push "$pkg" oci://ghcr.io/${{ github.repository_owner }}
|
|
done
|