ci: publish helm wrapper chart via web-app-serve-action v0.2.0#23
Merged
Conversation
Bump the publish action to the helm-capable v0.2.0 and add a thin wrapper chart (web-app-serve/helm) that CI resolves and publishes to GHCR alongside the image. The wrapper depends on the pinned web-app-serve-helm base chart (aliased app) with image name/tag and ingress annotations stamped in by CI. - Rename publish-web-app-serve.yml -> helm-publish.yaml (now also publishes the chart). - Grant contents: read and pull-requests: read (provenance writer needs the PR lookup); keep packages: write and submodules: true. - Add helm_publish: true explicitly. - Add a temporary feat/web-app-serve-helm push trigger to test the integration end-to-end (to be removed after merge).
thenav56
force-pushed
the
feat/web-app-serve-helm
branch
from
July 17, 2026 14:59
3ff564d to
8015a54
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
The docker
web-app-servepath already shipped upstream; this PR adds the K8sdeploy path (helm wrapper chart) and upgrades the publish workflow accordingly.
ci:— publish helm wrapper chart viaweb-app-serve-action@v0.2.0publish-web-app-serve.yml→helm-publish.yaml; action bumpedv0.1.1→v0.2.0(helm-capable;helm_publish: true).contents: read+pull-requests: read(the provenance writer resolves the PR from the commit); keptpackages: writeandsubmodules: true(thebackendsubmodule).web-app-serve/helm/(ercs-cms-helm), depending onoci://ghcr.io/toggle-corp/web-app-serve-helm:0.2.1aliasedapp. CI stamps image name/tag + provenance annotations and pushes the chart to GHCR on every develop push:oci://ghcr.io/toggle-corp/ercs-cms-helm, version0.0.1-develop.c<sha>.Verification
helm dependency update+helm lint+helm template(withapp.ingress.hostname/ingressClassName/image.nameset) all pass; Ingress + provenance labels render as expected.TODO before/after merge
feat/web-app-serve-helmentry fromon.push.branchesin.github/workflows/helm-publish.yaml— it exists only to test the publish workflow end-to-end on this branch (publishes toghcr.io/toggle-corp/ercs-cms-dev/ercs-cms-dev-helmbecause of the slash in the branch name).Notes for deployers
helm_target_revision; all overrides nest underapp:(image.{name,tag}are already baked in by CI). Supplyapp.ingress.hostname/app.ingress.ingressClassNameat deploy time.APP_apply-config caveat (unchanged by this PR, upstream FIXME): the base image's stock script has no sed-metachar escaping and no blank-unfilled step — avoid&/|in runtimeAPP_*values and set everyAPP_*var explicitly (""to opt out) so unset vars don't leak their literal placeholder.