feat: allow higher version release in helm rc bump CI but make a PR comment

Signed-off-by: suwhang-cisco <suwhang@cisco.com>

Author: suwhang-cisco

.github/workflows/helm-rc-version-bump.yml

@@ -81,8 +81,28 @@ jobs:
           echo "📋 Valid version pattern: $VALID_PATTERN"
           echo ""
 
+          # Function to extract base version (strip RC suffix)
+          get_base_version() {
+            echo "$1" | sed 's/-rc\.helm\.[0-9]*$//'
+          }
+
+          # Function to compare semver versions
+          # Returns: 0 if equal, 1 if first > second, 2 if first < second
+          compare_versions() {
+            local v1=$(get_base_version "$1")
+            local v2=$(get_base_version "$2")
+            if [[ "$v1" == "$v2" ]]; then
+              echo 0
+            elif [[ "$(printf '%s\n' "$v1" "$v2" | sort -V | head -n1)" == "$v2" ]]; then
+              echo 1  # v1 > v2
+            else
+              echo 2  # v1 < v2
+            fi
+          }
+
           VALIDATION_FAILED=false
           FAILED_CHARTS=""
+          AHEAD_CHARTS=""
 
           for CHART_FILE in $(find charts -name "Chart.yaml" -type f); do
             CHART_DIR=$(dirname "$CHART_FILE")
@@ -95,30 +115,48 @@ jobs:
             echo "   appVersion: $APP_VERSION"
 
             # Validate chart version
-            if [[ ! "$CHART_VERSION" =~ $VALID_PATTERN ]]; then
-              echo "   ❌ ERROR: Chart version '$CHART_VERSION' does not match release pattern"
-              echo "      Expected: '$RELEASE_VERSION' or '$RELEASE_VERSION-rc.helm.<number>'"
-              VALIDATION_FAILED=true
-              FAILED_CHARTS="$FAILED_CHARTS $CHART_NAME(version:$CHART_VERSION)"
-            else
+            if [[ "$CHART_VERSION" =~ $VALID_PATTERN ]]; then
               echo "   ✅ Chart version is valid"
+            else
+              VERSION_CMP=$(compare_versions "$CHART_VERSION" "$RELEASE_VERSION")
+              if [[ "$VERSION_CMP" == "1" ]]; then
+                echo "   ⚠️  WARNING: Chart version '$CHART_VERSION' is ahead of release '$RELEASE_VERSION'"
+                echo "      This PR may need to be rebased after the next release"
+                AHEAD_CHARTS="$AHEAD_CHARTS $CHART_NAME(version:$CHART_VERSION)"
+              else
+                echo "   ❌ ERROR: Chart version '$CHART_VERSION' does not match release pattern"
+                echo "      Expected: '$RELEASE_VERSION' or '$RELEASE_VERSION-rc.helm.<number>'"
+                VALIDATION_FAILED=true
+                FAILED_CHARTS="$FAILED_CHARTS $CHART_NAME(version:$CHART_VERSION)"
+              fi
             fi
 
             # Validate appVersion if it exists and is not empty
             if [[ -n "$APP_VERSION" && "$APP_VERSION" != "null" ]]; then
-              if [[ ! "$APP_VERSION" =~ $VALID_PATTERN ]]; then
-                echo "   ❌ ERROR: appVersion '$APP_VERSION' does not match release pattern"
-                echo "      Expected: '$RELEASE_VERSION' or '$RELEASE_VERSION-rc.helm.<number>'"
-                VALIDATION_FAILED=true
-                FAILED_CHARTS="$FAILED_CHARTS $CHART_NAME(appVersion:$APP_VERSION)"
-              else
+              if [[ "$APP_VERSION" =~ $VALID_PATTERN ]]; then
                 echo "   ✅ appVersion is valid"
+              else
+                APP_VERSION_CMP=$(compare_versions "$APP_VERSION" "$RELEASE_VERSION")
+                if [[ "$APP_VERSION_CMP" == "1" ]]; then
+                  echo "   ⚠️  WARNING: appVersion '$APP_VERSION' is ahead of release '$RELEASE_VERSION'"
+                  echo "      This PR may need to be rebased after the next release"
+                  AHEAD_CHARTS="$AHEAD_CHARTS $CHART_NAME(appVersion:$APP_VERSION)"
+                else
+                  echo "   ❌ ERROR: appVersion '$APP_VERSION' does not match release pattern"
+                  echo "      Expected: '$RELEASE_VERSION' or '$RELEASE_VERSION-rc.helm.<number>'"
+                  VALIDATION_FAILED=true
+                  FAILED_CHARTS="$FAILED_CHARTS $CHART_NAME(appVersion:$APP_VERSION)"
+                fi
               fi
             fi
 
             echo ""
           done
 
+          # Output ahead charts for PR comment
+          AHEAD_CHARTS=$(echo "$AHEAD_CHARTS" | xargs)
+          echo "ahead_charts=$AHEAD_CHARTS" >> $GITHUB_OUTPUT
+
           if [[ "$VALIDATION_FAILED" == "true" ]]; then
             echo ""
             echo "════════════════════════════════════════════════════════════════"
@@ -131,14 +169,67 @@ jobs:
             echo "All chart versions and appVersions must match one of:"
             echo "  - Exact release version: $RELEASE_VERSION"
             echo "  - RC version pattern: $RELEASE_VERSION-rc.helm.<number>"
+            echo "  - A higher version (if you're working on a future release)"
             echo ""
             echo "Please update the chart versions to match the latest release."
             echo "════════════════════════════════════════════════════════════════"
             exit 1
           fi
 
+          if [[ -n "$AHEAD_CHARTS" ]]; then
+            echo ""
+            echo "⚠️  Some charts have versions ahead of the current release."
+            echo "   This is allowed, but you may need to rebase after the next release."
+          fi
+
           echo "✅ All chart versions are valid against release version $RELEASE_VERSION"
 
+      - name: 💬 Comment on PR if charts are ahead
+        if: github.event_name == 'pull_request' && steps.validate.outputs.ahead_charts != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const aheadCharts = '${{ steps.validate.outputs.ahead_charts }}'.split(' ').filter(c => c);
+            const releaseVersion = '${{ steps.release.outputs.release_version }}';
+
+            const chartList = aheadCharts.map(c => `- \`${c}\``).join('\n');
+            const body = `## ⚠️ Chart Version Notice
+
+The following charts have versions **ahead** of the current release (\`${releaseVersion}\`):
+
+${chartList}
+
+This is allowed, but **you will need to rebase this PR** after a new release is created to ensure version consistency.
+
+If this is intentional (e.g., you're preparing for an upcoming release), you can ignore this message.`;
+
+            // Check if we already commented
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number
+            });
+
+            const botComment = comments.find(c =>
+              c.user.type === 'Bot' && c.body.includes('Chart Version Notice')
+            );
+
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: body
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: body
+              });
+            }
+
       - name: 🔍 Detect changed charts
         id: detect
         run: |