ci: publish web-app-serve helm wrapper chart

.github/workflows/helm-publish.yaml

@@ -0,0 +1,27 @@
+name: Publish web app serve
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - develop
+
+permissions:
+  contents: read       # checkout — a permissions block zeroes unlisted scopes
+  packages: write      # push image + chart to GHCR
+  pull-requests: read  # helm provenance writer resolves the PR from the commit
+
+jobs:
+  publish_image:
+    name: Publish Docker Image + Helm Chart
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Publish web-app-serve
+        uses: toggle-corp/web-app-serve-action@v0.2.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          helm_publish: true

web-app-serve/helm/.gitignore

@@ -0,0 +1,3 @@
+# Artifacts from `helm dependency update` — CI regenerates these; do not commit.
+charts/
+Chart.lock

web-app-serve/helm/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: ercs-client-helm
+description: "Wrapper Helm chart for ercs-client, depends on web-app-serve-helm"
+type: application
+version: 0.0.1-SET-BY-CICD          # own semver prefix; CI rewrites only SET-BY-CICD
+dependencies:
+  - name: web-app-serve-helm
+    version: 0.2.1
+    repository: oci://ghcr.io/toggle-corp
+    alias: app

web-app-serve/helm/values.yaml

@@ -0,0 +1,7 @@
+app:
+  fullnameOverride: ercs-client
+  image:
+    name: SET-BY-CICD-IMAGE   # CI seds these to the just-built image
+    tag: SET-BY-CICD-TAG
+  ingress:
+    annotations: {}           # pre-seed: the provenance writer FAILS if this parent node is missing