From c2260a02f75e84c0f3d8f432ec6ce6d41c355a52 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Thu, 16 Jul 2026 21:20:37 +0545 Subject: [PATCH 1/3] ci: publish helm wrapper chart via web-app-serve-action Migrate the web-app-serve publish workflow to the helm-capable action and add a thin wrapper Helm chart so CI publishes both the Docker image and a versioned chart to GHCR. - Rename publish-web-app-serve.yml -> helm-publish.yaml - Bump toggle-corp/web-app-serve-action v0.1.1 -> v0.2.0 (helm-capable) - Enable helm_publish: true - Grant contents: read + pull-requests: read (checkout + provenance writer); keep submodules: recursive - Add web-app-serve/helm wrapper chart (ercs-client-helm) depending on web-app-serve-helm 0.1.1 aliased app - Temporarily trigger the workflow on feat/web-app-serve-helm to test the integration end-to-end (marked TODO to remove after merge) --- .github/workflows/helm-publish.yaml | 29 +++++++++++++++++++++ .github/workflows/publish-web-app-serve.yml | 24 ----------------- web-app-serve/helm/.gitignore | 3 +++ web-app-serve/helm/Chart.yaml | 10 +++++++ web-app-serve/helm/values.yaml | 7 +++++ 5 files changed, 49 insertions(+), 24 deletions(-) create mode 100644 .github/workflows/helm-publish.yaml delete mode 100644 .github/workflows/publish-web-app-serve.yml create mode 100644 web-app-serve/helm/.gitignore create mode 100644 web-app-serve/helm/Chart.yaml create mode 100644 web-app-serve/helm/values.yaml diff --git a/.github/workflows/helm-publish.yaml b/.github/workflows/helm-publish.yaml new file mode 100644 index 0000000..bc1fe62 --- /dev/null +++ b/.github/workflows/helm-publish.yaml @@ -0,0 +1,29 @@ +name: Publish web app serve + +on: + workflow_dispatch: + push: + branches: + - develop + # TODO: This was added to test the integration, it can be removed after this is merged to repo's default branch + - feat/web-app-serve-helm + +permissions: + contents: read # checkout — a permissions block zeroes unlisted scopes + packages: write # push image + chart to GHCR + pull-requests: read # helm provenance writer resolves the PR from the commit + +jobs: + publish_image: + name: Publish Docker Image + Helm Chart + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Publish web-app-serve + uses: toggle-corp/web-app-serve-action@v0.2.0 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + helm_publish: true diff --git a/.github/workflows/publish-web-app-serve.yml b/.github/workflows/publish-web-app-serve.yml deleted file mode 100644 index 838facd..0000000 --- a/.github/workflows/publish-web-app-serve.yml +++ /dev/null @@ -1,24 +0,0 @@ -name: Publish web app serve - -on: - workflow_dispatch: - push: - branches: - - develop - -permissions: - packages: write - -jobs: - publish_image: - name: Publish Docker Image - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - with: - submodules: recursive - - - name: Publish web-app-serve - uses: toggle-corp/web-app-serve-action@v0.1.1 - with: - github_token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/web-app-serve/helm/.gitignore b/web-app-serve/helm/.gitignore new file mode 100644 index 0000000..b44294d --- /dev/null +++ b/web-app-serve/helm/.gitignore @@ -0,0 +1,3 @@ +# Artifacts from `helm dependency update` — CI regenerates these; do not commit. +charts/ +Chart.lock diff --git a/web-app-serve/helm/Chart.yaml b/web-app-serve/helm/Chart.yaml new file mode 100644 index 0000000..9793c4e --- /dev/null +++ b/web-app-serve/helm/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +name: ercs-client-helm +description: "Wrapper Helm chart for ercs-client, depends on web-app-serve-helm" +type: application +version: 0.0.1-SET-BY-CICD # own semver prefix; CI rewrites only SET-BY-CICD +dependencies: + - name: web-app-serve-helm + version: 0.1.1 + repository: oci://ghcr.io/toggle-corp + alias: app diff --git a/web-app-serve/helm/values.yaml b/web-app-serve/helm/values.yaml new file mode 100644 index 0000000..a305fec --- /dev/null +++ b/web-app-serve/helm/values.yaml @@ -0,0 +1,7 @@ +app: + fullnameOverride: ercs-client + image: + name: SET-BY-CICD-IMAGE # CI seds these to the just-built image + tag: SET-BY-CICD-TAG + ingress: + annotations: {} # pre-seed: the provenance writer FAILS if this parent node is missing From b5a8f3c919cd3d546c3cea52cede0d5ab7537240 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Fri, 17 Jul 2026 16:53:15 +0545 Subject: [PATCH 2/3] feat: upgrade web-app-serve-helm to 0.2.1 --- web-app-serve/helm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web-app-serve/helm/Chart.yaml b/web-app-serve/helm/Chart.yaml index 9793c4e..beca76e 100644 --- a/web-app-serve/helm/Chart.yaml +++ b/web-app-serve/helm/Chart.yaml @@ -5,6 +5,6 @@ type: application version: 0.0.1-SET-BY-CICD # own semver prefix; CI rewrites only SET-BY-CICD dependencies: - name: web-app-serve-helm - version: 0.1.1 + version: 0.2.1 repository: oci://ghcr.io/toggle-corp alias: app From 3df4db3abb73b48a168ad0e87957815049b67ab0 Mon Sep 17 00:00:00 2001 From: thenav56 Date: Fri, 17 Jul 2026 20:23:33 +0545 Subject: [PATCH 3/3] chore: cleanup feat/web-app-serve-helm from on.push --- .github/workflows/helm-publish.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/helm-publish.yaml b/.github/workflows/helm-publish.yaml index bc1fe62..12f4218 100644 --- a/.github/workflows/helm-publish.yaml +++ b/.github/workflows/helm-publish.yaml @@ -5,8 +5,6 @@ on: push: branches: - develop - # TODO: This was added to test the integration, it can be removed after this is merged to repo's default branch - - feat/web-app-serve-helm permissions: contents: read # checkout — a permissions block zeroes unlisted scopes