[NA]: Import Bitnami common helpers + automate chart version bump

[GuySaar8]

Summary

Two related changes:

1. Import the generically-useful Bitnami common helpers into this chart (Bitnami stopped maintaining the upstream library chart), renamed under the comet-common.* namespace.
2. Automate the chart version bump in CI so versions no longer have to be managed by hand in every PR — mirroring the comet-monitoring publish workflow.

---

1. Imported helpers — templates/_imported_bitnami_common.tpl

Ported from the Apache-2.0 Bitnami common chart, renamed common.* → comet-common.*, adapted for this chart:

Group	Helpers
Capabilities	kubeVersion, apiVersions.has, apiVersion resolvers for policy/networkPolicy/job/cronjob/daemonset/deployment/statefulset/ingress/rbac/crd/apiService/hpa/vpa, psp.supported, admissionConfiguration.*, podSecurityConfiguration.apiVersion, supportsHelmVersion
Storage	storage.class
Ingress	ingress.backend, ingress.certManagerRequest
Utils	fieldToEnvVar, getValueFromKey, getKeyFromList, secret.getvalue, checksumTemplate
Secrets	secrets.name, secrets.key, secrets.lookup, secrets.exists, secrets.passwords.manage
Compatibility	compatibility.isOpenshift, compatibility.renderSecurityContext
Names	names.namespace (new — required by secrets/utils)

Adaptations

• secrets.passwords.manage originally depends on Bitnami's common.validations.* tree and common.errors.upgrade.passwords.empty (full of subchart-specific logic and bitnami.com doc links). Those are ported in trimmed, de-Bitnamified form: a generic upgrade-with-empty-password error, no external links, no subchart indirection.
• Not imported (intentionally): helpers this chart already provides (names, labels, images, tplvalues, affinities, size presets), and Bitnami image-catalog-specific helpers (errors.insecureImages, _warnings.tpl).
• Apache-2.0 attribution header retained in the file; note added to the README.

README updated with a section documenting each new helper group + usage examples.

---

2. Release workflow — automated version bump

release.yaml now bumps the chart version in CI instead of relying on a manual Chart.yaml edit per PR.

• Trigger changed from push-to-main → workflow_dispatch with a bump choice input (patch / minor / major, default minor).
• A bump job computes the next SemVer, commits Bump chart version to X.Y.Z back to the branch, then the existing OCI release job packages and publishes to oci://ghcr.io/comet-ml and cuts the GitHub release.
• Why workflow_dispatch and not push: a push-triggered job that commits a version bump back to main would push a Chart.yaml change and re-trigger itself in an infinite loop. Manual dispatch avoids that. (This matches comet-monitoring, whose push trigger is likewise disabled in favor of dispatch.)
• helm-oci-release.yaml gains an optional ref input so the package step checks out the post-bump branch HEAD — without it, the reusable workflow's plain checkout would package the pre-bump commit and publish the old version.

Removed: verify-chart-version.yaml + helm-verify-chart-version.yaml

These workflows ran on every PR touching Chart.yaml / templates/** / values* and failed the PR unless Chart.yaml version was strictly greater than the latest release.

That gate made sense under manual versioning, but it directly conflicts with the new automated-bump model: now that the version is bumped by CI at release time, a feature PR's Chart.yaml legitimately equals the released version — so the check would block every feature PR and force exactly the manual bump we're trying to eliminate. The PR-time gate is now redundant, so both files are removed.

Chart.yaml is left at 0.2.0 (the current release); the first workflow_dispatch run will produce 0.3.0.

---

Verification

• helm lint passes.
• A throwaway consumer chart depending on comet-common renders every imported helper correctly (e.g. deployment.apiVersion → apps/v1, storage.class → storageClassName: …, ingress backend string→name:/int→number:, fieldToEnvVar my-password→MY_PASSWORD, secrets.passwords.manage → quoted base64, renderSecurityContext passthrough off-OpenShift).
• The upgrade-with-empty-password path correctly fails the render with the generic (non-Bitnami) error.
• Both remaining workflow files validate as YAML.

Note for reviewers

The bump job's git push to main uses the default GITHUB_TOKEN. If main has branch protection requiring PRs/reviews, that push will be rejected — in which case we'll need a PAT (like comet-monitoring's GH_PAT_TO_ACCESS_GITHUB_API) or a protection exception for the actions bot.

🤖 Generated with Claude Code