From fddec938090048bae8a55951f1708d6c4932ef8f Mon Sep 17 00:00:00 2001 From: TheMeinerLP Date: Tue, 25 Aug 2026 08:04:31 +0200 Subject: [PATCH] fix(ci): publish the Helm chart only after the image The helm job only depended on release-please, so it ran in parallel with the image build. Packaging and pushing a chart takes seconds while the build context, image build, chunked Harbor upload and signing take minutes, so the chart was reliably published pointing at an appVersion whose image did not exist yet - and stayed published even when the image build failed. Depend on the docker job as well, which also gates the chart on that job succeeding. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release-please.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index e692024..f47824d 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -86,7 +86,12 @@ jobs: # needs no chart of its own. helm: name: Publish the Helm chart - needs: release-please + # Also on `docker`, not just on the release: the chart is packaged with the + # release version as its appVersion, so pushing it before the image exists + # publishes a chart that points at a tag nobody can pull yet - and leaves + # one published for good if the image build fails. `needs` implies success, + # so a skipped or failed docker job skips the chart too. + needs: [release-please, docker] if: needs.release-please.outputs.release_created == 'true' runs-on: ubuntu-latest permissions: