Don't remove existing version from kumahq/charts index

[jijiechen]

Kuma Version

2.8.8

Describe the bug

Our current GitHub Actions CI sometimes removes existing versions from the charts repo when publishing a new helm chart version.

Problematic CI run:

• https://github.com/kumahq/kuma/actions/runs/14121157701/job/39565900562#step:7:51

Commits that removes an existing chart vesion:

• kumahq/charts@a9f2d28

In the example above, version 2.10.1 was removed when we ran the CI for publishing the helm chart version 2.8.8`

To Reproduce

No response

Expected behavior

No response

Additional context (optional)

No response

[lukidzi]

Triage: we should check this since helm/package/git? might be doing git push -f. When you have 2 runs simultaneously, it might override the previous one. We should avoid force push.

[lahabana]

odd: seems like we're doing a regular git push

kuma/tools/releases/helm.sh

Lines 91 to 129 in 679448b

	function release {
	if [ -z "${GH_TOKEN}" ] || [ -z "${GH_USER}" ] || [ -z "${GH_EMAIL}" ]; then
	msg_err "GH_TOKEN, GH_USER and GH_EMAIL required"
	fi
	if [ -n "${GITHUB_APP}" ]; then
	[ -z "$GH_REPO_URL" ] && GH_REPO_URL="https://x-access-token:${GH_TOKEN}@github.com/${GH_OWNER}/${GH_REPO}.git"
	else
	[ -z "$GH_REPO_URL" ] && GH_REPO_URL="https://${GH_TOKEN}@github.com/${GH_OWNER}/${GH_REPO}.git"
	fi
	git clone --single-branch --branch "${GH_PAGES_BRANCH}" "$GH_REPO_URL"
	# First upload the packaged charts to the release
	cr upload \
	--owner "${GH_OWNER}" \
	--git-repo "${GH_REPO}" \
	--token "${GH_TOKEN}" \
	--package-path "${CHARTS_PACKAGE_PATH}"
	# Then build and upload the index file to github pages
	cr index \
	--owner "${GH_OWNER}" \
	--git-repo "${GH_REPO}" \
	--charts-repo "${CHARTS_REPO_URL}" \
	--package-path "${CHARTS_PACKAGE_PATH}" \
	--index-path "${GH_REPO}/${CHARTS_INDEX_FILE}"
	pushd ${GH_REPO}
	git config user.name "${GH_USER}"
	git config user.email "${GH_EMAIL}"
	git add "${CHARTS_INDEX_FILE}"
	git commit -m "ci(helm): publish charts"
	git push
	popd
	rm -rf ${GH_REPO}
	}

[lahabana]

Maybe we should close after upload as upload can be long.

[lahabana]

First run:

PATH=/home/runner/work/kuma/kuma/.ci_tools/bin:$PATH ./tools/releases/helm.sh  --release
Cloning into 'charts'...
Using existing index at charts/index.yaml
Found kuma-2.10.1.tgz
Extracting chart metadata from .cr-release-packages/kuma-2.10.1.tgz
Calculating Hash for .cr-release-packages/kuma-2.10.1.tgz
Updating index charts/index.yaml
~/work/kuma/kuma/charts ~/work/kuma/kuma
[gh-pages e8e4264] ci(helm): publish charts
 1 file changed, 26 insertions(+), 1 deletion(-)
To https://github.com/kumahq/charts.git
   a3da9c7..e8e4264  gh-pages -> gh-pages

2nd run:

PATH=/home/runner/work/kuma/kuma/.ci_tools/bin:$PATH ./tools/releases/helm.sh  --release
Cloning into 'charts'...
Using existing index at charts/index.yaml
Found kuma-2.8.8.tgz
Extracting chart metadata from .cr-release-packages/kuma-2.8.8.tgz
Calculating Hash for .cr-release-packages/kuma-2.8.8.tgz
Updating index charts/index.yaml
~/work/kuma/kuma/charts ~/work/kuma/kuma
[gh-pages a9f2d28] ci(helm): publish charts
 1 file changed, 26 insertions(+), 26 deletions(-)
To https://github.com/kumahq/charts.git
   e8e4264..a9f2d28  gh-pages -> gh-pages
~/work/kuma/kuma

If you look the 2nd commit is based on the commit of the 1st run so it's not a race to commit but more a mix when computing the index.

[lahabana]

cr index might cache in some ways or something like this...

[jijiechen]

It looks the issue we ran into is exactly the some one reported here: helm/chart-releaser#143

It had been resolved in the cr version older than 1.4, and we are using 1.3 as of now (cr v1.3 was released on Nov 8, 2021)

kuma/mk/dependencies/helm.sh

Lines 11 to 12 in f18cff2

	CR_VERSION="1.3.0"
	cr=${OUTPUT_DIR}/cr

[jijiechen]

The root cause is well explained on the PR that fixes the issue helm/chart-releaser#144

So far the index.yaml was loaded directly from the chart repository... GitHub pages use a Content Delivery Network. So the index.yaml files fetched from there might be outdated... might lead to the situation that one downloads an old index file from and updated that one instead of the most recent index.yaml.