feat(github): publish the Helm chart to GHCR; skip immutable re-pushes #52

Merged

ryangr0 merged 2 commits from feat/ghcr-chart-and-immutable-skip into main 2026-08-25 10:11:51 +00:00

Conversation 0 Commits 2 Files changed 2 +102 -1

ryangr0 commented 2026-08-25 10:10:45 +00:00

Owner

Copy link

Closes the last two gaps in ploeg's release chain.

fix(helm): skip the push when the chart version is already published

Harbor tags are immutable, so re-publishing an existing version fails outright instead of no-opping. ploeg run 183:

PUT .../charts/ploeg/manifests/0.2.0-rc.23: 412 precondition:
  'charts/ploeg:0.2.0-rc.23' configured as immutable

This is the chart-side twin of the image probe already in ploeg's caller, and the last thing keeping a backfill from going fully green. helm show chart runs after the registry login (it needs the same credentials). Fail-open: anything but a clean hit falls through and pushes, exactly as a first publish does.

feat(github): publish the OCI Helm chart to GHCR

The GitHub track carried the repo, the release and the image, but not the chart — ghcr.io had no counterpart to Harbor's webgrip/charts/ploeg.

Built from source, not copied from Harbor, matching forgejo-distribute's publish-chart: helm package is deterministic from the tagged tree, and copying an OCI artifact by digest needs tooling the runner does not carry — imagetools understands image manifest lists, not Helm's config media type.

Lands at ghcr.io/<owner>/charts/<chart> by default, mirroring the Harbor layout and keeping charts out of the image namespace. Gated on chart-path being non-empty, so existing callers are unaffected, and independent of the ref and image jobs. Carries the same already-published probe.

Note on the reusable-collision constraint

The obvious alternative — a second helm-chart-push.yml call in ploeg with registry: ghcr.io — does not work. Forgejo v15 flattening collides two instances of the same reusable in one caller, which ploeg's own comments document. Putting the chart inside github-distribute.yml keeps it to one instance each.

helm-chart-push.yml is byte-identical between v1.0.0 and main, so ploeg bumping that pin picks up only this probe.

Closes the last two gaps in ploeg's release chain. ## `fix(helm)`: skip the push when the chart version is already published Harbor tags are immutable, so re-publishing an existing version fails outright instead of no-opping. ploeg run 183: ``` PUT .../charts/ploeg/manifests/0.2.0-rc.23: 412 precondition: 'charts/ploeg:0.2.0-rc.23' configured as immutable ``` This is the chart-side twin of the image probe already in ploeg's caller, and the last thing keeping a backfill from going fully green. `helm show chart` runs after the registry login (it needs the same credentials). Fail-open: anything but a clean hit falls through and pushes, exactly as a first publish does. ## `feat(github)`: publish the OCI Helm chart to GHCR The GitHub track carried the repo, the release and the image, but not the chart — ghcr.io had no counterpart to Harbor's `webgrip/charts/ploeg`. **Built from source, not copied from Harbor**, matching `forgejo-distribute`'s `publish-chart`: `helm package` is deterministic from the tagged tree, and copying an OCI artifact by digest needs tooling the runner does not carry — `imagetools` understands image manifest lists, not Helm's config media type. Lands at `ghcr.io/<owner>/charts/<chart>` by default, mirroring the Harbor layout and keeping charts out of the image namespace. Gated on `chart-path` being non-empty, so **existing callers are unaffected**, and independent of the ref and image jobs. Carries the same already-published probe. ### Note on the reusable-collision constraint The obvious alternative — a second `helm-chart-push.yml` call in ploeg with `registry: ghcr.io` — does not work. Forgejo v15 flattening collides two instances of the *same* reusable in one caller, which ploeg's own comments document. Putting the chart inside `github-distribute.yml` keeps it to one instance each. `helm-chart-push.yml` is byte-identical between `v1.0.0` and `main`, so ploeg bumping that pin picks up only this probe.

ryangr0 added 2 commits 2026-08-25 10:10:45 +00:00

fix(helm): skip the push when the chart version is already published ... 0ccd348cdd

Harbor tags are immutable, so re-publishing a version that is already there
fails the job outright instead of no-opping. ploeg run 183 died with

    PUT .../charts/ploeg/manifests/0.2.0-rc.23: 412 precondition:
      'charts/ploeg:0.2.0-rc.23' configured as immutable

on a backfill of a release whose chart was published on the original run. This
is the chart-side twin of the image probe already landed in ploeg's caller, and
the last thing that kept a re-publish from going green.

`helm show chart` against the target runs after the registry login, since it
needs the same credentials. Fail-open: anything but a clean hit falls through
and pushes, which is exactly what every first publish already does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

feat(github): publish the OCI Helm chart to GHCR ... ac958e9d43

The GitHub track carried the repo, the release and the image, but not the
chart — so ghcr.io had no counterpart to Harbor's webgrip/charts/ploeg.

Built from source rather than copied from Harbor, matching forgejo-distribute's
publish-chart: `helm package` is deterministic from the tagged tree, and
copying an OCI artifact by digest needs tooling the runner does not carry —
imagetools understands image manifest lists, not Helm's config media type.

Lands at ghcr.io/<owner>/charts/<chart> by default, mirroring the Harbor layout
and keeping charts out of the image namespace. The job is gated on chart-path
being non-empty, so existing callers are unaffected, and it is independent of
the ref and image jobs. The same already-published probe as the Harbor push
keeps it idempotent on a backfill.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ryangr0 merged commit 54de5edfdc into main 2026-08-25 10:11:51 +00:00

ryangr0 referenced this pull request from a commit 2026-08-25 10:11:52 +00:00

Merge pull request 'feat(github): publish the Helm chart to GHCR; skip immutable re-pushes' (#52) from feat/ghcr-chart-and-immutable-skip into main

webgrip-ci referenced this pull request from a commit 2026-08-25 10:12:54 +00:00

chore(release): v1.10.0 [skip ci]

renovate referenced this pull request from webgrip/twente.dev 2026-09-19 12:46:44 +00:00

fix(actions): Update dependency webgrip/workflows ( v1.6.0 ➔ v1.11.3 ) #21

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

pull-request

Mirrored from GitHub Pull Request

No labels

pull-request

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/workflows!52

No description provided.