Skip to content

Fix helm release action #2039

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 23, 2025
Merged

Fix helm release action #2039

merged 1 commit into from
Jul 23, 2025

Conversation

ZIJ
Copy link
Contributor

@ZIJ ZIJ commented Jul 23, 2025

No description provided.

@ZIJ ZIJ merged commit cbb7be7 into develop Jul 23, 2025
12 checks passed
Copy link
Contributor

bismuthdev bot commented Jul 23, 2025

Summary of Bugs Found in Codebase

Total bugs found: 3

Critical Issues

  1. Missing Validation in Helm Release Workflow: The helm-release.yml workflow doesn't validate charts before publishing them to the registry, which could result in invalid charts being published.

  2. Branch Configuration Risk: The helm-release.yml workflow runs only on the develop branch, which could lead to version conflicts if the same workflow were to run on multiple branches, as it would overwrite previously published charts.

  3. Security Vulnerability in Release Process: The lack of validation in the release workflow creates a security risk where someone could bypass the PR process (which includes validation) by pushing directly to the develop branch.

These issues primarily affect the Helm chart release process, potentially compromising the integrity and security of published charts.

Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Greptile Summary

This PR updates the Helm chart release workflow to trigger on pushes to the develop branch instead of main. The change affects two files:

  1. .github/workflows/helm-release.yml: Modified the workflow trigger from main to develop branch
  2. helm-charts/CLAUDE.md: Updated documentation to correctly reflect that releases trigger on develop branch

This change aligns the Helm release process with the repository's branching strategy, where develop serves as the primary integration branch rather than the conventional main branch. The workflow automatically packages and publishes Helm charts to GitHub Container Registry (oci://ghcr.io/diggerhq/helm-charts/digger-backend) when changes are detected in the helm-charts/ directory.

The repository follows a non-standard branching approach where develop is the default branch, and this PR ensures both the workflow configuration and documentation accurately reflect this setup. The documentation updates include emphasized warnings about this deviation from typical Git conventions to prevent future confusion.

Confidence score: 3/5

  • This change switches Helm chart releases from a stable branch (main) to a development branch (develop), which could introduce less stable releases
  • The change correctly aligns workflow configuration with repository branching strategy but may impact release stability
  • .github/workflows/helm-release.yml needs attention as it now publishes from a development branch rather than a stable release branch

2 files reviewed, 1 comment

Edit Code Review Bot Settings | Greptile

@@ -3,7 +3,7 @@ name: Release Helm Charts
on:
push:
branches:
- main
- develop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style: Publishing Helm charts from develop branch may introduce instability. Consider whether chart releases should come from a more stable branch

Comment on lines 3 to 8
on:
push:
branches:
- main
- develop
paths:
- 'helm-charts/**'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current helm-release.yml workflow is configured to run only on the develop branch. If this workflow were to exist on the main branch or be restored later, there could be version conflicts since the same chart versions could be released from both branches.

The workflow pushes Helm charts to the OCI registry at ghcr.io/diggerhq/helm-charts without any branch-specific path or versioning scheme. If the same chart version (defined in Chart.yaml) is pushed from both branches, the later push would overwrite the earlier one, potentially causing inconsistencies.

I've added a workflow_dispatch trigger to allow manual execution when needed, which provides more control over when releases happen. However, a more complete solution would be to either:

  1. Ensure this workflow only exists on one branch
  2. Add branch-specific versioning or paths in the registry
  3. Implement version checks before pushing
Suggested change
on:
push:
branches:
- main
- develop
paths:
- 'helm-charts/**'
on:
push:
branches:
- develop
paths:
- 'helm-charts/**'
workflow_dispatch:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant