feat(helm): Add a support of OCI Helm chart - #739
Conversation
Signed-off-by: Nicolas Lamirault <nicolas.lamirault@gmail.com>
WalkthroughThe release workflow adds GitHub Container Registry publishing: expands job permissions to include packages: write, logs into ghcr.io using docker/login-action, and pushes Helm chart packages from .cr-release-packages to ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts after running chart-releaser. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant WF as GitHub Actions Runner
participant CR as chart-releaser
participant GHCR as ghcr.io (OCI)
participant GH as GitHub API
Dev->>WF: Push tag / trigger release workflow
WF->>GH: Use GITHUB_TOKEN (contents:write, packages:write)
WF->>CR: Run chart-releaser
CR-->>WF: Produce .cr-release-packages/*
note over WF: New step
WF->>GHCR: docker/login-action authenticate (actor + GITHUB_TOKEN)
alt Packages exist
loop for each package in .cr-release-packages/*
WF->>GHCR: helm push pkg to oci://ghcr.io/${owner}/charts
GHCR-->>WF: Acknowledge push
end
else No packages
WF-->>WF: Skip push (nullglob guard)
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/release.yaml (1)
45-52: Login step is solid; consider native Helm auth as an alternativedocker/login-action is pinned (good). Optional: replace with native Helm auth to reduce dependencies:
- helm registry login ghcr.io -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}"
Functionally equivalent; your choice.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/release.yaml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: test-chart
🔇 Additional comments (3)
.github/workflows/release.yaml (3)
14-15: Correct: added packages: write permission enables GHCR pushesThis is required for publishing to ghcr.io with GITHUB_TOKEN. Looks good.
44-44: No-op whitespaceSafe to keep as-is.
53-61: Tighten push loop: fail-fast, avoid redundant guard, and target only .tgzReplace in .github/workflows/release.yaml:
- - name: Push charts to GHCR - run: | - shopt -s nullglob - for pkg in .cr-release-packages/*; do - if [ -z "${pkg:-}" ]; then - break - fi - helm push "${pkg}" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts" - done + - name: Push charts to GHCR + run: | + set -euo pipefail + shopt -s nullglob + for pkg in .cr-release-packages/*.tgz; do + echo "Pushing ${pkg} → oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts" + helm push "${pkg}" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts" + donePlease verify your runner’s Helm version (v3.10.3+) supports OCI push (e.g.
helm versionshows ≥3.10.3 andhelm help pushlists the push command).
1 participant
Summary by CodeRabbit
New Features
Chores