ci: publish web-app-serve helm wrapper chart#8
Merged
Conversation
Migrate the web-app-serve publish workflow to the helm-capable action and add a thin wrapper Helm chart so CI publishes both the Docker image and a versioned chart to GHCR. - Rename publish-web-app-serve.yml -> helm-publish.yaml - Bump toggle-corp/web-app-serve-action v0.1.1 -> v0.2.0 (helm-capable) - Enable helm_publish: true - Grant contents: read + pull-requests: read (checkout + provenance writer); keep submodules: recursive - Add web-app-serve/helm wrapper chart (ercs-client-helm) depending on web-app-serve-helm 0.1.1 aliased app - Temporarily trigger the workflow on feat/web-app-serve-helm to test the integration end-to-end (marked TODO to remove after merge)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
The web-app-serve docker/runtime path already exists upstream on
develop(v2
env.ts, base image as-is,APP_prefix). This PR adds only the Helm CIpublish path (CHECKLIST §7 fast path — a single
ci:commit, nothing app-sidechanges).
ci:— publish helm wrapper chart viaweb-app-serve-action@v0.2.0publish-web-app-serve.yml→helm-publish.yaml; actionbumped
v0.1.1→v0.2.0(first helm-capable release;helm_publish: true).contents: read(apermissions:block zeroesunlisted scopes, so checkout needs it) +
pull-requests: read(the provenancewriter resolves the PR from the commit).
packages: writeandsubmodules: recursivekept.web-app-serve/helm/(ercs-client-helm), depending onoci://ghcr.io/toggle-corp/web-app-serve-helm:0.2.1aliasedapp. CI stampsthe image name/tag + provenance annotations and pushes the chart to GHCR on
every develop push:
oci://ghcr.io/toggle-corp/ercs-client-helm, version0.0.1-develop.c<sha>.Verification
helm dependency update+helm lint+helm template(with--set app.ingress.hostname,app.ingress.ingressClassName,app.image.name) all pass.this change does not touch it, so §9's docker checks were not re-run.
TODO before/after merge
feat/web-app-serve-helmentry fromon.push.branchesin.github/workflows/helm-publish.yaml— it existsonly to test the publish workflow end-to-end on this branch (the slash in
the branch name makes it publish to
ghcr.io/toggle-corp/ercs-client-dev/
ercs-client-dev-helm).Notes for deployers (stock
APP_apply-config limitations, pre-existing)This repo uses the base image's stock apply-config (no custom
apply-config.sh),which has no sed-metachar escaping and no blank-unfilled step (upstream FIXME).
These are inherent to the existing docker path (not introduced here):
&or|in any runtimeAPP_*value.APP_*var explicitly at deploy time (use""to opt out ofoptional ones); a truly-unset var leaks its literal placeholder into the
bundle.