Merge pull request #28 from emsearcy/helm-frozen-deps

Ensure Helm dependencies are correctly frozen

Author: jordane

.github/workflows/mega-linter.yml

@@ -29,6 +29,20 @@ jobs:
         with:
           fetch-depth: 0
 
+      # Installs packaged subcharts under charts/*/charts/*.tgz. Also
+      # fails if the Chart.lock digest is wrong.
+      - name: Helm dependency fetch
+        shell: bash
+        run: |
+          set -euo pipefail
+          for chart in charts/*; do
+            if [ -f "${chart}/Chart.lock" ]; then
+              yq -r '.dependencies[] | select(.repository | contains("oci://") == false) | "\(.name) \(.repository)"' \
+                "${chart}/Chart.yaml" | xargs -L1 helm repo add --force-update
+              helm dependency build "${chart}"
+            fi
+          done
+
       # MegaLinter
       - name: MegaLinter
         id: ml

.github/workflows/release.yaml

@@ -43,7 +43,7 @@ jobs:
 
       - name: Publish Chart to GHCR
         id: publish-ghcr
-        uses: linuxfoundation/lfx-public-workflows/.github/actions/helm-chart-oci-publisher@a5d0271f539e3f69194cca94d9884914c3be088b
+        uses: linuxfoundation/lfx-public-workflows/.github/actions/helm-chart-oci-publisher@e619121ece4ca4b1d6c89ade032f26105505756d
         with:
           name: ${{ steps.prepare.outputs.chart_name }}
           repository: ${{ github.repository }}/chart

.mega-linter.yml

@@ -37,5 +37,3 @@ SPELL_VALE_PRE_COMMANDS:
 FILTER_REGEX_EXCLUDE: '(templates/.*\.yml|templates/.*\.yaml)'
 KUBERNETES_DIRECTORY: charts/lfx-platform
 KUBERNETES_HELM_ARGUMENTS: charts/lfx-platform
-KUBERNETES_HELM_PRE_COMMANDS:
-  - command: helm dependency update charts/lfx-platform

charts/lfx-platform/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: traefik
-  repository: https://traefik.github.io/charts
+  repository: oci://ghcr.io/traefik/helm
   version: 36.2.0
 - name: openfga
   repository: https://openfga.github.io/helm-charts
   version: 0.2.39
 - name: heimdall
-  repository: https://dadrus.github.io/heimdall/charts
+  repository: oci://ghcr.io/dadrus/heimdall/chart
   version: 0.15.8
 - name: nats
   repository: https://nats-io.github.io/k8s/helm/charts/
@@ -32,5 +32,5 @@ dependencies:
 - name: trust-manager
   repository: https://charts.jetstack.io
   version: v0.18.0
-digest: sha256:591a323ff20b90c4b50fd92c63788e91d7e08ff2606f155af26e38527680a84d
-generated: "2025-08-06T11:35:55.1914-07:00"
+digest: sha256:62f9779ba2521042d18193fcaa7010ed905045c61579997d6551b2e9c23437fc
+generated: "2025-08-06T13:14:49.133573-07:00"

charts/lfx-platform/Chart.yaml

@@ -9,15 +9,15 @@ version: 0.1.11
 icon: https://github.com/linuxfoundation/lfx-v2-helm/raw/main/img/lfx-logo-color.svg
 dependencies:
   - name: traefik
-    repository: https://traefik.github.io/charts
+    repository: oci://ghcr.io/traefik/helm
     version: ~36.2.0
     condition: traefik.enabled
   - name: openfga
     repository: https://openfga.github.io/helm-charts
     version: ~0.2.37
     condition: openfga.enabled
   - name: heimdall
-    repository: https://dadrus.github.io/heimdall/charts
+    repository: oci://ghcr.io/dadrus/heimdall/chart
     version: ~0.15.6
     condition: heimdall.enabled
   - name: nats