hermes-agent 1.3.0: README — the localhost-displayed webhook route wo… #949
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/publish-charts.yml | |
| name: Publish Helm Charts | |
| # Branch pushes publish to the test registry (templates/test) for pre-merge testing. | |
| # Pushes to main (i.e. merges) publish to the production registry automatically — | |
| # the merge is the release decision; quality gates run before it (PR validation + review). | |
| on: | |
| push: | |
| branches: ['**'] | |
| workflow_dispatch: | |
| inputs: | |
| migrate: | |
| description: 'Package all charts (migration mode)' | |
| type: boolean | |
| default: false | |
| template: | |
| description: 'Specific template to package e.g. nginx (leave empty for diff-based)' | |
| type: string | |
| default: '' | |
| version: | |
| description: 'Specific version to package e.g. 1.4.0 (leave empty for all versions)' | |
| type: string | |
| default: '' | |
| # One run per branch at a time: a new push supersedes its own stale run instead of | |
| # queueing behind it. main is never cancelled — a half-finished production publish | |
| # is worse than a slow one. | |
| concurrency: | |
| # main gets a group PER COMMIT, not per ref. `cancel-in-progress: false` only | |
| # protects the run that is already executing — GitHub still permits just ONE | |
| # pending run per group and cancels the older pending one when a newer arrives. | |
| # With a shared `publish-refs/heads/main` group, merging five PRs in under a | |
| # minute silently cancelled two of them ("Canceling since a higher priority | |
| # waiting request for publish-refs/heads/main exists") and duckdb 1.0.0 and | |
| # polaris 1.0.0 were never published, while their PRs showed green. A skipped | |
| # publish is far worse than a slow one, so on main nothing may ever contend. | |
| # Branches still dedupe by ref and cancel stale runs — that is where pile-ups | |
| # actually cost something and where losing a run is harmless. | |
| group: ${{ github.ref == 'refs/heads/main' && format('publish-main-{0}', github.sha) || format('publish-{0}', github.ref) }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| jobs: | |
| setup: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| version_dirs: ${{ steps.charts.outputs.version_dirs }} | |
| charts: ${{ steps.charts.outputs.charts }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 2 | |
| - name: Determine charts to package | |
| id: charts | |
| run: | | |
| if [ "${{ github.event.inputs.migrate }}" = "true" ] && [ "${{ github.ref }}" = "refs/heads/main" ]; then | |
| charts=$(find . -name "Chart.yaml" -path "*/versions/*" \ | |
| | sed 's|/versions/.*||' | sed 's|^\./||' | sort -u \ | |
| | tr '\n' ' ') | |
| echo "charts=$charts" >> $GITHUB_OUTPUT | |
| elif [ -n "${{ github.event.inputs.template }}" ]; then | |
| echo "charts=${{ github.event.inputs.template }}" >> $GITHUB_OUTPUT | |
| else | |
| version_dirs=$(git diff --name-only HEAD^ HEAD \ | |
| | grep -E '^[^/]+/versions/[^/]+/' \ | |
| | sed -E 's|^([^/]+/versions/[^/]+)/.*|\1|' | sort -u \ | |
| | tr '\n' ' ') | |
| echo "version_dirs=$version_dirs" >> $GITHUB_OUTPUT | |
| fi | |
| validate: | |
| needs: [setup] | |
| if: github.event_name != 'workflow_dispatch' && (needs.setup.outputs.version_dirs != '' || needs.setup.outputs.charts != '') | |
| uses: ./.github/workflows/validate-charts.yml | |
| with: | |
| version_dirs: ${{ needs.setup.outputs.version_dirs }} | |
| charts: ${{ needs.setup.outputs.charts }} | |
| publish: | |
| needs: [setup, validate] | |
| if: always() && (needs.setup.outputs.version_dirs != '' || needs.setup.outputs.charts != '') && (needs.validate.result == 'success' || needs.validate.result == 'skipped') | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 2 | |
| - name: Install Helm | |
| uses: azure/setup-helm@v3 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to GHCR | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io \ | |
| --username ${{ github.actor }} \ | |
| --password-stdin | |
| - name: Determine registry | |
| id: registry | |
| run: | | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ] || [ "${{ github.ref }}" = "refs/heads/main" ]; then | |
| echo "path=oci://ghcr.io/controlplane-com/templates" >> $GITHUB_OUTPUT | |
| else | |
| echo "path=oci://ghcr.io/controlplane-com/templates/test" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Package and push | |
| run: | | |
| mkdir -p .packaged | |
| # The OCI registry throttles when several runs pull cpln-common at once. | |
| # Bound each attempt and retry with backoff, and never hide the reason. | |
| helm_dep_update() { | |
| local dir="$1" n=1 | |
| while [ "$n" -le 3 ]; do | |
| if timeout 300 helm dependency update "$dir"; then return 0; fi | |
| echo "helm dependency update failed for $dir (attempt $n/3)" | |
| [ "$n" -lt 3 ] && sleep $((n * 15)) | |
| n=$((n + 1)) | |
| done | |
| return 1 | |
| } | |
| package_and_push() { | |
| local version_dir="${1%/}" | |
| if [ -f "$version_dir/Chart.yaml" ]; then | |
| local template=$(echo "$version_dir" | cut -d/ -f1) | |
| local version=$(grep '^version:' "$version_dir/Chart.yaml" | awk '{print $2}') | |
| if [ -n "${{ github.event.inputs.version }}" ] && \ | |
| [ "$version" != "${{ github.event.inputs.version }}" ]; then | |
| return | |
| fi | |
| echo "Packaging $template @ $version..." | |
| if ! helm_dep_update "$version_dir"; then | |
| echo "Skipping $template @ $version - dependency update failed" | |
| return | |
| fi | |
| helm package "$version_dir" -d .packaged/ || { echo "Skipping $template @ $version - package error"; return; } | |
| helm push ".packaged/$template-$version.tgz" \ | |
| ${{ steps.registry.outputs.path }} || { echo "Skipping push $template @ $version"; return; } | |
| echo "Done: $template @ $version" | |
| fi | |
| } | |
| if [ -n "${{ needs.setup.outputs.version_dirs }}" ]; then | |
| for version_dir in ${{ needs.setup.outputs.version_dirs }}; do | |
| package_and_push "$version_dir" | |
| done | |
| else | |
| for template in ${{ needs.setup.outputs.charts }}; do | |
| for version_dir in "$template"/versions/*/; do | |
| package_and_push "$version_dir" | |
| done | |
| done | |
| fi |