ci: also publish charts to GHCR as OCI artifacts - #36
Open
hisco wants to merge 2 commits into
Open
Conversation
Mirror each chart-releaser package to oci://ghcr.io/skyhook-io/charts after the HTTP repo (gh-pages) and GitHub Release are published, so enterprise catalogs that consume charts over OCI (NKP, Rancher, Argo/Flux) can pull oci://ghcr.io/skyhook-io/charts/<name>. - add packages: write and azure/setup-helm - push only charts chart-releaser actually packaged this run (.cr-release-packages/*.tgz) - skip if the name+version already exists in the registry, so an unrelated commit never overwrites an existing immutable chart digest The HTTP Helm repo and Artifact Hub listing are unchanged. Claude-Session: https://claude.ai/code/session_01JV8VHKekHyabojMnJ74mti
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2d65c3b. Configure here.
Bugbot: azure/setup-helm@v4 without a version input installs latest (now Helm 4.x), leaving the untested-on-Helm-4 OCI push path exposed. Match ci.yaml exactly (setup-helm@v5, version v3.14.0) for a single, tested Helm line across the repo. Claude-Session: https://claude.ai/code/session_01JV8VHKekHyabojMnJ74mti
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
After chart-releaser publishes to the HTTP repo (gh-pages) and GitHub Releases, mirror each newly-packaged chart to the GHCR OCI registry at
oci://ghcr.io/skyhook-io/charts/<name>.Why
OCI is the modern Helm distribution format (Helm 3.8+) and is what enterprise catalogs consume natively — NKP, Rancher, Argo CD, Flux. Without an OCI path, our charts cannot be listed in those catalogs. This matches the dual-publish posture of enterprise-facing charts (cert-manager → quay, Bitnami → docker.io), while keeping the existing HTTP Helm repo and Artifact Hub listing unchanged.
How
packages: writepermission +azure/setup-helm@v4.cr-release-packages/*.tgz), so it never re-pushes unchanged chartsname+versionalready exists in the registry, so an unrelated commit can never overwrite an existing (immutable) chart digestVerified locally
actionlintcleanradarchart resolves tooci://ghcr.io/skyhook-io/charts/radarManual step required after first successful run
The first push creates a private GHCR package. It must be flipped to public in the package settings, then verified with a logged-out
helm show chart oci://ghcr.io/skyhook-io/charts/radar --version <v>. Until that flip, anonymous pulls return 403.https://claude.ai/code/session_01JV8VHKekHyabojMnJ74mti
Note
Low Risk
CI-only publishing change with no application runtime impact; main follow-up is making the new GHCR packages public for anonymous pulls.
Overview
Extends the release workflow so charts that chart-releaser packages on
mainare also published to GHCR as OCI artifacts atoci://ghcr.io/skyhook-io/charts/<name>, alongside the existing HTTP/gh-pages and GitHub Releases flow.Adds
packages: write, installs Helm 3.14.0, and a post–chart-releaser step that only runs when.cr-release-packages/*.tgzexist. Each tarball is pushed after login; pushes are skipped when that chart name+version is already present in the registry to avoid changing digests for immutable versions.Reviewed by Cursor Bugbot for commit b7cb878. Bugbot is set up for automated code reviews on this repo. Configure here.