Skip to content

ci: publish charts with hevi instead of chart-releaser-action #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tada5hi merged 1 commit into from
Aug 4, 2026
Merged

ci: publish charts with hevi instead of chart-releaser-action #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 19 additions & 27 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ jobs:
with:
token: ${{ secrets.GITHUB_TOKEN }}

# Runs on every master push. chart-releaser compares Chart.yaml's version
# against the published releases (CR_SKIP_EXISTING), so this is an idempotent
# no-op until the release-please PR carrying a version bump is merged. Do NOT
# gate this on release-please outputs: the chart package uses
# skip-github-release (chart-releaser owns tags + releases), so
# releases_created never fires for it.
# Runs on every master push. hevi compares Chart.yaml's version against the
# published releases (cr --skip-existing) and against the OCI registry
# (push-skip-existing), so this is an idempotent no-op until the release-please
# PR carrying a version bump is merged. Do NOT gate this on release-please
# outputs: the chart package uses skip-github-release (chart-releaser owns tags
# + releases), so releases_created never fires for it.
publish:
runs-on: ubuntu-latest
needs: release-please
Expand All @@ -39,28 +39,20 @@ jobs:
git config user.name "$GITHUB_ACTOR"
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

# hevi prefers a helm from PATH over its own pinned download, so pin it
# here to keep the packaged output independent of the runner image.
- name: Set up Helm
uses: azure/setup-helm@v4
Comment on lines +42 to 45

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify that this workflow does not set an explicit Helm version.
sed -n '42,46p' .github/workflows/release.yaml

# Verify the action's current input default.
curl -fsSL https://raw.githubusercontent.com/Azure/setup-helm/v4/action.yml | sed -n '1,12p'

Repository: authup/helm

Length of output: 835

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the release workflow around Helm/Hevi invocation and any installed binaries.
nl -ba .github/workflows/release.yaml | sed -n '1,160p' | rg -n "Set up Helm|hevi|helm|HEVI|install|uses: azure/setup-helm|version:" -C 3

# Inspect Hevi invocations in the workflow and repository config to establish PATH precedence.
rg -n "hevi|HEVI|setup-helm|/.*helm|helm" .github/workflows/release.yaml . 2>/dev/null | head -n 120

Repository: authup/helm

Length of output: 185

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "release workflow relevant section:"
sed -n '1,160p' .github/workflows/release.yaml
echo

echo "Helm/Hevi related references in release workflow:"
grep -nE "Set up Helm|hevi|HEVI|helm|setup-helm|version:" .github/workflows/release.yaml || true

echo
echo "General Helm/Hevi references in tracked repo files (first 150 matches):"
grep -RInE "hevi|HEVI|setup-helm|\\bhelm\\b|helm" .github workflows 2>/dev/null | head -n 150 || true

Repository: authup/helm

Length of output: 3355

Pin the Helm binary version.

azure/setup-helm@v4 defaults version to latest. This release job uses Hevi after installing Helm without a fixed version, so a new upstream Helm release can change chart packaging, release notes, or OCI push behavior. Set an explicit, vetted Helm version in azure/setup-helm@v4.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yaml around lines 42 - 45, Update the “Set up
Helm” workflow step using azure/setup-helm@v4 to provide an explicit, vetted
version value instead of relying on the latest default, while preserving the
existing PATH setup used by Hevi.

Comment on lines +42 to 45

- name: Run chart-releaser
uses: helm/chart-releaser-action@v1
- name: Package, release and push charts
uses: tada5hi/hevi@v2
with:
charts_repo_url: https://helm.authup.org
env:
CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CR_SKIP_EXISTING: "true"
CR_GENERATE_RELEASE_NOTES: "true"

- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Push charts to GHCR (OCI)
run: |
shopt -s nullglob
for pkg in .cr-release-packages/*.tgz; do
helm push "$pkg" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/helm-charts"
done
directory: charts
package: true
release: true
release-generate-notes: true
push: true
push-host: ghcr.io/${{ github.repository_owner }}/helm-charts
push-username: ${{ github.actor }}
push-password: ${{ secrets.GITHUB_TOKEN }}
push-skip-existing: true
Comment on lines +47 to +58

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n 'uses:\s*tada5hi/hevi@' .github/workflows/release.yaml
git ls-remote https://github.com/tada5hi/hevi.git refs/tags/v2 refs/tags/v2.0.1

Repository: authup/helm

Length of output: 294

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Workflow relevant lines:\n'
sed -n '40,65p' .github/workflows/release.yaml | nl -ba -v40

printf '\nGitHub API refs/tags/v2 object type and sha:\n'
gh api repos/tada5hi/hevi/git/refs/tags/v2 --jq '{ref: .ref, type: .object.type, sha: .object.sha}'

printf '\nIf annotated tag, dereference to commit:\n'
ref_type="$(gh api repos/tada5hi/hevi/git/refs/tags/v2 --jq '.object.type')"
ref_sha="$(gh api repos/tada5hi/hevi/git/refs/tags/v2 --jq '.object.sha')"
if [ "$ref_type" = tag ]; then
  gh api "repos/tada5hi/hevi/git/tags/${ref_sha}" --jq '{object_type: .object.type, object_sha: .object.sha}'
fi

printf '\nExplicit tag dereference commit hash with git ls-remote:\n'
git ls-remote https://github.com/tada5hi/hevi.git refs/tags/v2^{0} refs/tags/v2.0.1

Repository: authup/helm

Length of output: 214

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Workflow relevant lines:\n'
sed -n '40,65p' .github/workflows/release.yaml

printf '\nGit ls-remote refs:\n'
git ls-remote https://github.com/tada5hi/hevi.git refs/tags/v2 refs/tags/v2.0.1 refs/tags/v2^{0}

Repository: authup/helm

Length of output: 1026

Pin Hevi to an immutable revision.

uses: tada5hi/hevi@v2 is a mutable tag that receives secrets.GITHUB_TOKEN. Pin it to the reviewed commit hash and update it through a reviewed dependency change.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yaml around lines 47 - 58, Update the “Package,
release and push charts” workflow step to replace the mutable tada5hi/hevi@v2
reference with the reviewed immutable commit SHA, preserving all existing inputs
and permissions. Ensure future Hevi revisions are introduced through a reviewed
dependency update.

1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,6 @@
*.tgz
.cr-release-packages/
.cr-index/
.hevi/
charts/*/values.local.yaml
charts/*/values.personal.yaml
Loading