ci(chart): publish the dploy Helm chart as a signed OCI artifact - #40
Merged
Conversation
Add a dedicated Chart workflow mirroring docker.yml's split behavior: - Every branch / PR: helm lint + template render + package smoke test, so chart regressions surface before a tag is cut (ci.yml didn't cover the chart at all). - On v* tags: package with the version/appVersion synced to the tag, push to oci://ghcr.io/<owner>/charts, and cosign-sign the pushed artifact by digest (keyless, id-token). Charts publish under a "charts/" path so the OCI artifact doesn't collide with the container images already at ghcr.io/<owner>/dploy(-operator). Install: helm install dploy oci://ghcr.io/aydev-fr/charts/dploy --version X.Y.Z Claude-Session: https://claude.ai/code/session_01M4Dd5oASBGHwr6ts6wTnYn
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a dedicated
Chartworkflow (.github/workflows/chart.yml) that validates the Helm chart on every branch/PR and publishes it as a signed OCI artifact on release tags. Modeled on the existingdocker.ymlsplit behavior.Why
ci.ymlnever touchedcharts/dploy, so chart regressions only surfaced at install time. And the chart wasn't distributed anywhere — users had to clone the repo. This makes the chart a first-class, signed, versioned release artifact.Behavior
helm lint+helm templaterender +helm packagesmoke test.v*tags → package withversion/appVersionsynced to the tag, push to OCI, andcosign-sign the pushed artifact by digest (keyless, viaid-token) — matching howrelease.ymlsigns the container images.Note on the OCI path
The API image already lives at
ghcr.io/aydev-fr/dploy. A chart pushed to that same path would collide with the container package (both are OCI artifacts in one namespace), so charts publish under acharts/sub-path:Configurable via the
CHART_NAMESPACEenv in the workflow.Validation
Locally verified before wiring CI:
helm lint, template render, and a realhelm packageall pass; workflow YAML parses clean. The publish job only runs onv*tags, so merging this is inert until the next release tag is cut.