ci: publish charts with hevi instead of chart-releaser-action - #4
Merged
Conversation
Replaces the chart-releaser-action step, the docker/login-action step and the hand-rolled `helm push` loop with a single tada5hi/hevi@v2 step that packages, releases and pushes to the OCI registry. Semantics are preserved: - releases keep the <chart>-<version> name, since hevi does not override chart-releaser's default --release-name-template, so release-please keeps its version baseline - the job stays ungated and idempotent: hevi always passes --skip-existing to `cr upload`, and push-skip-existing probes the registry before pushing, which the previous `helm push` loop did not do - release notes stay generated, via release-generate-notes charts_repo_url is dropped because it is already a no-op: helm/chart-releaser-action@v1 declares no such input and no current chart-releaser release has the flag, so it was silently ignored. setup-helm is kept on purpose. hevi prefers a helm from PATH over its own pinned download, so pinning here keeps the packaged output independent of the runner image. Requires hevi >= 2.0.1, where `helm registry login` is given the bare registry rather than the full ghcr.io/<owner>/helm-charts reference, which helm 4 rejects.
📝 WalkthroughWalkthroughChangesHevi release publishing
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Hevi
participant GitHubReleases
participant GHCR
GitHubActions->>Hevi: Run hevi with GitHub token
Hevi->>Hevi: Package Helm charts
Hevi->>GitHubReleases: Create release with generated notes
Hevi->>GHCR: Push Helm charts
Hevi->>GHCR: Skip existing packages
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yaml:
- Around line 42-45: Update the “Set up Helm” workflow step using
azure/setup-helm@v4 to provide an explicit, vetted version value instead of
relying on the latest default, while preserving the existing PATH setup used by
Hevi.
- Around line 47-58: Update the “Package, release and push charts” workflow step
to replace the mutable tada5hi/hevi@v2 reference with the reviewed immutable
commit SHA, preserving all existing inputs and permissions. Ensure future Hevi
revisions are introduced through a reviewed dependency update.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1afb710e-3b49-4183-8c51-b3b47c9eb8ef
📒 Files selected for processing (2)
.github/workflows/release.yaml.gitignore
Comment on lines
+42
to
45
| # hevi prefers a helm from PATH over its own pinned download, so pin it | ||
| # here to keep the packaged output independent of the runner image. | ||
| - name: Set up Helm | ||
| uses: azure/setup-helm@v4 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify that this workflow does not set an explicit Helm version.
sed -n '42,46p' .github/workflows/release.yaml
# Verify the action's current input default.
curl -fsSL https://raw.githubusercontent.com/Azure/setup-helm/v4/action.yml | sed -n '1,12p'Repository: authup/helm
Length of output: 835
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the release workflow around Helm/Hevi invocation and any installed binaries.
nl -ba .github/workflows/release.yaml | sed -n '1,160p' | rg -n "Set up Helm|hevi|helm|HEVI|install|uses: azure/setup-helm|version:" -C 3
# Inspect Hevi invocations in the workflow and repository config to establish PATH precedence.
rg -n "hevi|HEVI|setup-helm|/.*helm|helm" .github/workflows/release.yaml . 2>/dev/null | head -n 120Repository: authup/helm
Length of output: 185
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "release workflow relevant section:"
sed -n '1,160p' .github/workflows/release.yaml
echo
echo "Helm/Hevi related references in release workflow:"
grep -nE "Set up Helm|hevi|HEVI|helm|setup-helm|version:" .github/workflows/release.yaml || true
echo
echo "General Helm/Hevi references in tracked repo files (first 150 matches):"
grep -RInE "hevi|HEVI|setup-helm|\\bhelm\\b|helm" .github workflows 2>/dev/null | head -n 150 || trueRepository: authup/helm
Length of output: 3355
Pin the Helm binary version.
azure/setup-helm@v4 defaults version to latest. This release job uses Hevi after installing Helm without a fixed version, so a new upstream Helm release can change chart packaging, release notes, or OCI push behavior. Set an explicit, vetted Helm version in azure/setup-helm@v4.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yaml around lines 42 - 45, Update the “Set up
Helm” workflow step using azure/setup-helm@v4 to provide an explicit, vetted
version value instead of relying on the latest default, while preserving the
existing PATH setup used by Hevi.
Comment on lines
+47
to
+58
| - name: Package, release and push charts | ||
| uses: tada5hi/hevi@v2 | ||
| with: | ||
| charts_repo_url: https://helm.authup.org | ||
| env: | ||
| CR_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| CR_SKIP_EXISTING: "true" | ||
| CR_GENERATE_RELEASE_NOTES: "true" | ||
|
|
||
| - name: Login to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Push charts to GHCR (OCI) | ||
| run: | | ||
| shopt -s nullglob | ||
| for pkg in .cr-release-packages/*.tgz; do | ||
| helm push "$pkg" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/helm-charts" | ||
| done | ||
| directory: charts | ||
| package: true | ||
| release: true | ||
| release-generate-notes: true | ||
| push: true | ||
| push-host: ghcr.io/${{ github.repository_owner }}/helm-charts | ||
| push-username: ${{ github.actor }} | ||
| push-password: ${{ secrets.GITHUB_TOKEN }} | ||
| push-skip-existing: true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n 'uses:\s*tada5hi/hevi@' .github/workflows/release.yaml
git ls-remote https://github.com/tada5hi/hevi.git refs/tags/v2 refs/tags/v2.0.1Repository: authup/helm
Length of output: 294
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Workflow relevant lines:\n'
sed -n '40,65p' .github/workflows/release.yaml | nl -ba -v40
printf '\nGitHub API refs/tags/v2 object type and sha:\n'
gh api repos/tada5hi/hevi/git/refs/tags/v2 --jq '{ref: .ref, type: .object.type, sha: .object.sha}'
printf '\nIf annotated tag, dereference to commit:\n'
ref_type="$(gh api repos/tada5hi/hevi/git/refs/tags/v2 --jq '.object.type')"
ref_sha="$(gh api repos/tada5hi/hevi/git/refs/tags/v2 --jq '.object.sha')"
if [ "$ref_type" = tag ]; then
gh api "repos/tada5hi/hevi/git/tags/${ref_sha}" --jq '{object_type: .object.type, object_sha: .object.sha}'
fi
printf '\nExplicit tag dereference commit hash with git ls-remote:\n'
git ls-remote https://github.com/tada5hi/hevi.git refs/tags/v2^{0} refs/tags/v2.0.1Repository: authup/helm
Length of output: 214
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Workflow relevant lines:\n'
sed -n '40,65p' .github/workflows/release.yaml
printf '\nGit ls-remote refs:\n'
git ls-remote https://github.com/tada5hi/hevi.git refs/tags/v2 refs/tags/v2.0.1 refs/tags/v2^{0}Repository: authup/helm
Length of output: 1026
Pin Hevi to an immutable revision.
uses: tada5hi/hevi@v2 is a mutable tag that receives secrets.GITHUB_TOKEN. Pin it to the reviewed commit hash and update it through a reviewed dependency change.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yaml around lines 47 - 58, Update the “Package,
release and push charts” workflow step to replace the mutable tada5hi/hevi@v2
reference with the reviewed immutable commit SHA, preserving all existing inputs
and permissions. Ensure future Hevi revisions are introduced through a reviewed
dependency update.
There was a problem hiding this comment.
Pull request overview
Migrates the chart publishing workflow from helm/chart-releaser-action plus a custom GHCR push loop to a single tada5hi/hevi step, simplifying packaging, GitHub releases, index publishing, and OCI pushing for the authup/helm chart repo.
Changes:
- Replace
helm/chart-releaser-action+docker/login-action+ manualhelm pushloop withtada5hi/hevi@v2in the release workflow. - Add
.hevi/to.gitignoreto ignore hevi build artifacts.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.gitignore |
Ignores hevi-generated artifacts (.hevi/) created during packaging/release. |
.github/workflows/release.yaml |
Reworks the publish job to run packaging, GitHub release/index publishing, and GHCR OCI pushing via a single hevi step. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+42
to
45
| # hevi prefers a helm from PATH over its own pinned download, so pin it | ||
| # here to keep the packaged output independent of the runner image. | ||
| - name: Set up Helm | ||
| uses: azure/setup-helm@v4 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates the publish job from
helm/chart-releaser-actionplus a hand-rolled OCI loop to a single hevi step. This makes authup/helm hevi's second consumer alongside PrivateAIM/helm, and closes out the checklist in tada5hi/hevi#52.Three steps collapse into one:
helm/chart-releaser-action@v1+CR_*envrelease: true,release-generate-notes: truedocker/login-action@v3helm registry loginitselfhelm pushloop over.cr-release-packages/*.tgzpush: true,push-skip-existing: truePreserved semantics
--release-name-template, so releases and tags stayauthup-<version>and release-please keeps its version baseline.skip-github-releasemeansreleases_creatednever fires for the chart component. hevi always passes--skip-existingtocr upload.release-generate-notes.versionizeis deliberately not enabled. release-please owns theChart.yamlbump; hevi only packages, releases and pushes.Behaviour changes
push-skip-existingprobes the registry withhelm show chartbefore pushing. The previous loop re-pushed every chart on every master push, overwriting the same GHCR tag.charts_repo_url: https://helm.authup.orgis dropped. This is not a regression:helm/chart-releaser-action@v1declares nocharts_repo_urlinput (it is absent from bothaction.ymlandcr.sh), and no current chart-releaser release has the flag. It was being silently ignored. Moderncr indexmerges against the realindex.yamlon the pages branch and writes absolute GitHub release asset URLs, so the custom domain is unaffected.setup-helmis kept on purpose. hevi prefers ahelmfromPATHover its own pinned download, so pinning here keeps the packaged output independent of the runner image.Requires hevi >= 2.0.1
helm pushneeds the fullghcr.io/<owner>/helm-chartsreference, buthelm registry loginonly accepts the bare registry. helm 3 tolerated the path, helm 4 rejects it withinvalid reference: invalid registry. hevi 2.0.1 splits the two.@v2currently resolves to 2.0.1.Worth verifying on the first run
gh-pagesbranch keeps unrelated files, notablyCNAME. chart-releaser only commits the index, so this should hold, but it has not been exercised through hevi yet.index.yamlentry URLs still point at the release asset downloads.Summary by CodeRabbit