pulse/.github/workflows/publish-helm-chart.yml

name: Publish Helm Chart

# Triggers:
# - release: published — fires when a release is initially created with
#   draft=false (legacy publish path).
# - workflow_call — called from create-release.yml after validate_release_assets
#   succeeds. create-release.yml's publish step creates releases as drafts and
#   PATCHes to draft=false later, which does NOT fire the `release: published`
#   webhook (GitHub-documented quirk). Without this workflow_call trigger,
#   v6 rc.1 → rc.5 published successfully but never produced a Helm chart on
#   rcourtman.github.io/Pulse/index.yaml — customers running
#   `helm install pulse pulse/pulse --version 6.0.0-rc.5` got chart-not-found.
# - workflow_dispatch — manual backfill / re-publish path.

on:
  release:
    types: [published]
  workflow_call:
    inputs:
      chart_version:
        description: "Chart version (e.g., 6.0.0-rc.5). Required for workflow_call."
        required: true
        type: string
      app_version:
        description: "Application version to embed (defaults to chart version)."
        required: false
        type: string
        default: ""
  workflow_dispatch:
    inputs:
      chart_version:
        description: "Chart version (required when running manually, use format 4.24.0)"
        required: true
      app_version:
        description: "Application version to embed (defaults to chart version)"
        required: false

permissions:
  contents: read

jobs:
  publish:
    name: Package and Push Helm Chart
    runs-on: ubuntu-24.04
    permissions:
      contents: write  # Required for gh release upload
      packages: write
    steps:
      - name: Determine chart version
        id: versions
        env:
          INPUT_CHART_VERSION: ${{ inputs.chart_version }}
          INPUT_APP_VERSION: ${{ inputs.app_version }}
          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          # inputs.chart_version is set by both workflow_dispatch and
          # workflow_call (from create-release.yml). Fall back to the
          # release-event tag only when running from a `release: published`
          # webhook with no inputs.
          if [ -n "${INPUT_CHART_VERSION}" ]; then
            CHART_VERSION="${INPUT_CHART_VERSION}"
            APP_VERSION="${INPUT_APP_VERSION}"
            if [ -z "$APP_VERSION" ]; then
              APP_VERSION="$CHART_VERSION"
            fi
            RELEASE_TAG="v${CHART_VERSION}"
          else
            RELEASE_TAG="${RELEASE_TAG_NAME}"
            if [ -z "$RELEASE_TAG" ]; then
              echo "::error::No chart_version input supplied and release event has no tag_name"
              exit 1
            fi
            CHART_VERSION="${RELEASE_TAG#v}"
            APP_VERSION="$CHART_VERSION"
          fi

          IS_PRERELEASE="false"
          if [[ "$APP_VERSION" =~ -rc\.[0-9]+$ ]] || [[ "$APP_VERSION" =~ -alpha\.[0-9]+$ ]] || [[ "$APP_VERSION" =~ -beta\.[0-9]+$ ]]; then
            IS_PRERELEASE="true"
          fi

          echo "chart_version=$CHART_VERSION" >> "$GITHUB_OUTPUT"
          echo "app_version=$APP_VERSION" >> "$GITHUB_OUTPUT"
          echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
          echo "is_prerelease=$IS_PRERELEASE" >> "$GITHUB_OUTPUT"

      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Set up Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
        with:
          version: v3.15.2

      - name: Validate release line policy
        id: release_line
        env:
          RELEASE_TAG: ${{ steps.versions.outputs.release_tag }}
          APP_VERSION: ${{ steps.versions.outputs.app_version }}
        run: |
          set -euo pipefail

          REQUIRED_BRANCH="$(python3 scripts/release_control/control_plane.py --branch-for-version "${APP_VERSION}")"

          if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
            git fetch --prune --unshallow origin
          fi
          git fetch --prune origin "${REQUIRED_BRANCH}" --tags

          if ! git rev-parse -q --verify "refs/tags/${RELEASE_TAG}" >/dev/null; then
            echo "::error::Tag ${RELEASE_TAG} does not exist. Helm publish must map to a real Git tag."
            exit 1
          fi

          TAG_COMMIT="$(git rev-list -n1 "refs/tags/${RELEASE_TAG}")"
          if ! git merge-base --is-ancestor "$TAG_COMMIT" "origin/${REQUIRED_BRANCH}"; then
            echo "::error::Tag ${RELEASE_TAG} is not reachable from origin/${REQUIRED_BRANCH}. Refusing cross-line Helm publish."
            exit 1
          fi

          echo "required_branch=${REQUIRED_BRANCH}" >> "$GITHUB_OUTPUT"
          echo "[OK] ${RELEASE_TAG} validated against release line ${REQUIRED_BRANCH}"

      - name: Check out validated release tag
        env:
          RELEASE_TAG: ${{ steps.versions.outputs.release_tag }}
        run: |
          set -euo pipefail
          git checkout --detach "refs/tags/${RELEASE_TAG}"

      - name: Align chart metadata links
        run: |
          python3 scripts/sync_chart_release_metadata.py \
            --chart deploy/helm/pulse/Chart.yaml \
            --version "${{ steps.versions.outputs.chart_version }}" \
            --repo "${{ github.repository }}"

      - name: Helm lint (strict)
        run: helm lint deploy/helm/pulse --strict

      - name: Package chart
        run: |
          mkdir -p dist
          helm package deploy/helm/pulse \
            --version "${{ steps.versions.outputs.chart_version }}" \
            --app-version "${{ steps.versions.outputs.app_version }}" \
            --destination dist

      - name: Upload packaged chart artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: pulse-chart-${{ steps.versions.outputs.chart_version }}
          path: dist/pulse-${{ steps.versions.outputs.chart_version }}.tgz

      - name: Authenticate with GHCR
        run: |
          echo "${{ github.token }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin

      - name: Push chart to GHCR
        run: |
          helm push dist/pulse-${{ steps.versions.outputs.chart_version }}.tgz \
            oci://ghcr.io/${{ github.repository_owner }}/pulse-chart

      - name: Configure package visibility
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          # Connect package to repository and set visibility to public
          # This ensures the package inherits public visibility and appears in repo packages
          gh api -X PUT /user/packages/container/pulse-chart/versions/latest/restore || true
          gh api -X PATCH /user/packages/container/pulse-chart -f visibility=public || true

          # Also try org endpoint if user endpoint fails
          gh api -X PATCH /orgs/${{ github.repository_owner }}/packages/container/pulse-chart -f visibility=public || true

          echo "Package visibility configuration attempted. Verify at: https://github.com/${{ github.repository_owner }}?tab=packages"

      - name: Attach chart to release
        if: github.event_name == 'release'
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          gh release upload "${{ steps.versions.outputs.release_tag }}" \
            dist/pulse-${{ steps.versions.outputs.chart_version }}.tgz \
            --clobber