Use helm repo

.github/workflows/release.yaml

@@ -1,45 +1,30 @@
 name: Release Chart
 
 on:
-  workflow_dispatch:
-    inputs:
-      chart_path:
-        description: "Path to the chart directory to release"
-        required: true
-        default: "."
-        type: choice
-        options:
-          - "."
+  push:
+    branches: [main]
+    paths:
+      - 'Chart.yaml'
 
 jobs:
   release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      pages: write
-
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           fetch-depth: 0
 
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v4
-
-      - name: Update dependencies
-        run: helm dependency update ${{ inputs.chart_path }} || true
+      - name: Install Helm
+        run: curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 
       - name: Get chart version
         id: chart
         run: |
-          echo "version=$(grep '^version:' ${{ inputs.chart_path }}/Chart.yaml | awk '{print $2}')" >> $GITHUB_OUTPUT
-          echo "name=$(grep '^name:' ${{ inputs.chart_path }}/Chart.yaml | awk '{print $2}')" >> $GITHUB_OUTPUT
+          echo "version=$(grep '^version:' Chart.yaml | awk '{print $2}')" >> $GITHUB_OUTPUT
+          echo "name=$(grep '^name:' Chart.yaml | awk '{print $2}')" >> $GITHUB_OUTPUT
 
       - name: Check if release exists
         id: check
@@ -52,10 +37,21 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Package chart
+      - name: Update Helm dependencies
         if: steps.check.outputs.exists == 'false'
-        run: helm package ${{ inputs.chart_path }}
+        run: helm dependency update .
 
+      - name: Package chart
+        if: steps.check.outputs.exists == 'false'
+        run: helm package .
+
+      # Publishing a GitHub release fires the `release: published` event, which
+      # the "Sync Helm Chart" workflow consumes to open a PR against
+      # nebari-dev/helm-repository. That repository packages, indexes (with
+      # `helm repo index --merge`, preserving every prior version), and
+      # publishes the chart. This repo therefore no longer maintains its own
+      # gh-pages Helm index — which is what previously collapsed the index to a
+      # single version on every release.
       - name: Create GitHub release
         if: steps.check.outputs.exists == 'false'
         run: |
@@ -64,20 +60,4 @@ jobs:
             --generate-notes \
             *.tgz
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Update Helm repo index
-        if: steps.check.outputs.exists == 'false'
-        run: |
-          mkdir -p gh-pages
-          cp *.tgz gh-pages/
-          cd gh-pages
-          git init
-          git checkout -b gh-pages
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-          git remote add origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
-          helm repo index . --url https://github.com/${{ github.repository }}/releases/download/${{ steps.chart.outputs.name }}-${{ steps.chart.outputs.version }}
-          git add .
-          git commit -m "Release ${{ steps.chart.outputs.name }}-${{ steps.chart.outputs.version }}"
-          git push origin gh-pages --force
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/sync-helm-chart.yml

@@ -0,0 +1,55 @@
+name: Sync Helm Chart to nebari-dev/helm-repository
+
+# Onboards this chart to the central Nebari Helm repository. On each published
+# GitHub release (cut by release.yaml when Chart.yaml changes on main),
+# this opens a PR against nebari-dev/helm-repository copying the chart into
+# charts/nebari-mlflow-pack/. When that PR merges, helm-repository packages,
+# indexes (with `helm repo index --merge`, preserving prior versions), and
+# publishes the chart + index to https://nebari-dev.github.io/helm-repository/.
+#
+# Prerequisite (one-time, by a helm-repository maintainer): the bot token must
+# exist as the org/repo secret NEBARI_HELM_REPO_TOKEN. See
+# https://github.com/nebari-dev/helm-repository/blob/main/.github/actions/sync-chart/README.md
+
+on:
+  # Fire on a chart version bump landing on main (same signal release.yaml
+  # uses). NOT `release: published` — that release is created by release.yaml
+  # via GITHUB_TOKEN, and events from GITHUB_TOKEN do not cascade to other
+  # workflows, so a release-triggered sync would never run.
+  push:
+    branches: [main]
+    paths:
+      - 'Chart.yaml'
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Skip PR creation and just lint the chart"
+        required: false
+        default: 'false'
+        type: boolean
+
+jobs:
+  sync:
+    name: Sync chart
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout calling repository
+        uses: actions/checkout@v4
+
+      - name: Sync chart to helm-repository
+        if: github.event.inputs.dry-run != 'true'
+        uses: nebari-dev/helm-repository/.github/actions/sync-chart@main
+        with:
+          chart-path: .
+          token: ${{ secrets.NEBARI_HELM_REPO_TOKEN }}
+          pr-labels: 'automated,helm-sync'
+
+      - name: Install Helm (dry-run)
+        if: github.event.inputs.dry-run == 'true'
+        uses: azure/setup-helm@v4
+
+      - name: Lint chart (dry-run)
+        if: github.event.inputs.dry-run == 'true'
+        run: helm lint .