Skip to content

Commit d3d40b0

Browse files
casibbaldcasibbald
committed
feat: implement unified release system for Helm chart synchronization
- Fix release-please configuration contradictions - Remove charts from exclude-paths, add structured extra-files - Disable separate-pull-requests for unified releases - Create unified-release.yaml workflow with version validation - Disable legacy helm.yaml and release-please.yaml workflows - Update chart version to sync with app version (0.39.0-rc.2) - Remove manual chart updates from prepare-release.yaml - Add comprehensive documentation for new release system Resolves Helm chart release synchronization issues: - Eliminates version misalignment between app and chart - Supports prerelease versions (RC) automatically - Provides single source of truth for all releases - Includes validation and error handling Scope: CI/CD workflows and release configuration only No application code changes
1 parent 3128f1f commit d3d40b0

File tree

9 files changed

+1001
-28
lines changed

9 files changed

+1001
-28
lines changed

‎.github/workflows/helm.yaml‎ renamed to ‎.github/workflows/helm.yaml.disabled‎

File renamed without changes.

‎.github/workflows/prepare-release.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -47,16 +47,16 @@ jobs:
4747
yarn test -u
4848
git commit -am "Update javascript library version to $GITOPS_VERSION"
4949
50-
- name: Update Chart
50+
# NOTE: Chart updates are now handled automatically by release-please
51+
# in the unified-release.yaml workflow. This manual step is no longer needed.
52+
- name: Chart Update Notice
5153
run: |
52-
# Increment the micro chart version
53-
NEW_CHART_VERSION=$(yq e '.version' charts/gitops-server/Chart.yaml | awk -F. -v OFS=. '{ $3++; print }')
54-
yq e '.appVersion = "${{ github.event.inputs.version }}"' -i charts/gitops-server/Chart.yaml
55-
yq e '.version = "'$NEW_CHART_VERSION'"' -i charts/gitops-server/Chart.yaml
56-
yq e '.image.tag = "${{ github.event.inputs.version }}"' -i charts/gitops-server/values.yaml
57-
58-
git commit -am "Update helm chart to $NEW_CHART_VERSION to use gitops $GITOPS_VERSION"
59-
if: ${{ !contains(github.event.inputs.version, '-') }}
54+
echo "ℹ️ Chart version updates are now handled automatically by release-please"
55+
echo "📋 The unified-release.yaml workflow will update:"
56+
echo " - Chart appVersion to match application version"
57+
echo " - Chart version to match application version (without 'v' prefix)"
58+
echo " - Image tag in values.yaml"
59+
echo "✅ No manual chart updates required"
6060
- name: Generate updated helm reference
6161
# Needs to run after chart update, before docs update
6262
run: |

‎.github/workflows/release-please.yaml‎

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,45 @@
11
---
2-
name: release-please
2+
name: release-please-legacy
33

4+
# DISABLED: This workflow has been replaced by unified-release.yaml
5+
# The unified workflow handles both application and Helm chart releases synchronously
46
on:
5-
push:
6-
branches:
7-
- main
7+
workflow_dispatch:
8+
inputs:
9+
force_run:
10+
description: 'Force run legacy workflow (for emergency use only)'
11+
required: true
12+
default: 'false'
13+
type: choice
14+
options:
15+
- 'false'
16+
- 'true'
817

918
permissions:
1019
contents: read
1120

1221
jobs:
22+
legacy-workflow-notice:
23+
runs-on: ubuntu-latest
24+
if: "${{ github.event.inputs.force_run != 'true' }}"
25+
steps:
26+
- name: Legacy workflow notice
27+
run: |
28+
echo "❌ This legacy workflow has been disabled"
29+
echo "✅ Use the unified-release.yaml workflow instead"
30+
echo "🔄 The unified workflow synchronizes both app and Helm chart releases"
31+
echo ""
32+
echo "If you need to run this legacy workflow for emergency purposes:"
33+
echo "1. Re-run this workflow"
34+
echo "2. Set 'force_run' input to 'true'"
35+
exit 1
36+
1337
release-please:
1438
runs-on: ubuntu-latest
1539
permissions:
1640
contents: write
1741
pull-requests: write
18-
if: "${{ github.repository_owner == 'weaveworks' && github.ref_name == 'main' }}"
42+
if: "${{ github.repository_owner == 'weaveworks' && github.event.inputs.force_run == 'true' }}"
1943
outputs:
2044
release_created: ${{ steps.release-please.outputs.release_created }}
2145
tag_name: ${{ steps.release-please.outputs.tag_name }}

‎.github/workflows/unified-release.yaml‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
---
2+
name: Unified Release
3+
4+
on:
5+
push:
6+
branches:
7+
- main
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
release-please:
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write
17+
pull-requests: write
18+
if: "${{ github.repository_owner == 'weaveworks' && github.ref_name == 'main' }}"
19+
outputs:
20+
release_created: ${{ steps.release-please.outputs.release_created }}
21+
tag_name: ${{ steps.release-please.outputs.tag_name }}
22+
version: ${{ steps.release-please.outputs.version }}
23+
major: ${{ steps.release-please.outputs.major }}
24+
minor: ${{ steps.release-please.outputs.minor }}
25+
patch: ${{ steps.release-please.outputs.patch }}
26+
steps:
27+
- name: Release Please
28+
id: release-please
29+
uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.2.0
30+
with:
31+
token: ${{ secrets.WEAVE_GITOPS_BOT_ACCESS_TOKEN }}
32+
33+
validate-versions:
34+
needs: release-please
35+
runs-on: ubuntu-latest
36+
if: "${{ needs.release-please.outputs.release_created }}"
37+
steps:
38+
- name: Checkout
39+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
40+
41+
- name: Validate chart version synchronization
42+
run: |
43+
APP_VERSION="${{ needs.release-please.outputs.version }}"
44+
CHART_APP_VERSION=$(yq e '.appVersion' charts/gitops-server/Chart.yaml)
45+
CHART_VERSION=$(yq e '.version' charts/gitops-server/Chart.yaml)
46+
IMAGE_TAG=$(yq e '.image.tag' charts/gitops-server/values.yaml)
47+
48+
echo "Application Version: $APP_VERSION"
49+
echo "Chart AppVersion: $CHART_APP_VERSION"
50+
echo "Chart Version: $CHART_VERSION"
51+
echo "Image Tag: $IMAGE_TAG"
52+
53+
# Validate that chart appVersion matches application version
54+
if [[ "$CHART_APP_VERSION" != "$APP_VERSION" ]]; then
55+
echo "❌ Error: Chart appVersion ($CHART_APP_VERSION) does not match application version ($APP_VERSION)"
56+
exit 1
57+
fi
58+
59+
# Validate that image tag matches application version
60+
if [[ "$IMAGE_TAG" != "$APP_VERSION" ]]; then
61+
echo "❌ Error: Image tag ($IMAGE_TAG) does not match application version ($APP_VERSION)"
62+
exit 1
63+
fi
64+
65+
# Validate that chart version follows expected pattern (remove 'v' prefix from app version)
66+
EXPECTED_CHART_VERSION=$(echo "$APP_VERSION" | sed 's/^v//')
67+
if [[ "$CHART_VERSION" != "$EXPECTED_CHART_VERSION" ]]; then
68+
echo "❌ Error: Chart version ($CHART_VERSION) does not match expected version ($EXPECTED_CHART_VERSION)"
69+
exit 1
70+
fi
71+
72+
echo "✅ All versions are synchronized correctly"
73+
74+
publish-npm-package:
75+
needs: [release-please, validate-versions]
76+
runs-on: ubuntu-latest
77+
permissions:
78+
packages: write # needed for GitHub Packages registry access
79+
if: "${{ needs.release-please.outputs.release_created }}"
80+
steps:
81+
- name: Checkout
82+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
83+
- name: Setup Node.js
84+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
85+
with:
86+
node-version-file: package.json
87+
registry-url: "https://npm.pkg.github.com"
88+
scope: "@weaveworks"
89+
- run: yarn
90+
- run: make ui-lib && cd dist && npm publish
91+
env:
92+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
93+
94+
build-and-push-image:
95+
needs: [release-please, validate-versions]
96+
uses: ./.github/workflows/build-push-image.yaml
97+
with:
98+
file: gitops-server.dockerfile
99+
flavor: |
100+
latest=true
101+
image: ghcr.io/weaveworks/wego-app
102+
platforms: linux/amd64,linux/arm64
103+
push: true
104+
tags: |
105+
type=raw,value=${{ needs.release-please.outputs.tag_name }}
106+
type=semver,pattern={{version}},value=${{ needs.release-please.outputs.version }}
107+
permissions:
108+
contents: read # for actions/checkout to fetch code
109+
id-token: write # for Cosign to be able to sign images with GHA token
110+
packages: write # for docker/build-push-action to push images
111+
if: "${{ needs.release-please.outputs.release_created }}"
112+
113+
build-and-push-chart:
114+
needs: [release-please, validate-versions, build-and-push-image]
115+
runs-on: ubuntu-latest
116+
permissions:
117+
contents: read # for actions/checkout to fetch code
118+
id-token: write # for Cosign to be able to sign chart with GHA token
119+
packages: write # for helm to push OCI chart
120+
if: "${{ needs.release-please.outputs.release_created }}"
121+
steps:
122+
- name: Checkout
123+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
124+
125+
- name: Validate chart before packaging
126+
run: |
127+
APP_VERSION="${{ needs.release-please.outputs.version }}"
128+
CHART_VERSION=$(yq e '.version' charts/gitops-server/Chart.yaml)
129+
130+
echo "Packaging chart version: $CHART_VERSION for app version: $APP_VERSION"
131+
132+
# Validate chart syntax
133+
helm lint charts/gitops-server/
134+
135+
- name: Package chart
136+
run: |
137+
mkdir helm-release
138+
helm package charts/gitops-server/ -d helm-release
139+
140+
# List packaged chart for verification
141+
ls -la helm-release/
142+
143+
- name: Log in to the Container registry
144+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
145+
with:
146+
registry: ghcr.io
147+
username: ${{ github.actor }}
148+
password: ${{ secrets.GITHUB_TOKEN }}
149+
150+
- name: Publish chart
151+
id: publish-chart
152+
run: |
153+
CHART_VERSION=$(yq e '.version' charts/gitops-server/Chart.yaml)
154+
CHART_FILE="helm-release/weave-gitops-${CHART_VERSION}.tgz"
155+
156+
if [[ ! -f "$CHART_FILE" ]]; then
157+
echo "❌ Error: Chart file $CHART_FILE not found"
158+
ls -la helm-release/
159+
exit 1
160+
fi
161+
162+
echo "Publishing chart: $CHART_FILE"
163+
helm push "$CHART_FILE" oci://ghcr.io/weaveworks/charts &> helm-release/push-metadata.txt
164+
165+
# Extract digest for signing
166+
CHART_DIGEST=$(awk '/Digest: /{print $2}' helm-release/push-metadata.txt)
167+
echo "Chart digest: $CHART_DIGEST"
168+
echo "digest=$CHART_DIGEST" >> $GITHUB_OUTPUT
169+
170+
# Display push metadata for debugging
171+
echo "Push metadata:"
172+
cat helm-release/push-metadata.txt
173+
174+
- name: Install cosign
175+
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
176+
177+
- name: Keyless signing of chart
178+
run: |
179+
cosign sign --yes ghcr.io/weaveworks/charts@${{ steps.publish-chart.outputs.digest }}
180+
181+
- name: Verify the chart signing
182+
run: |
183+
cosign verify ghcr.io/weaveworks/charts@${{ steps.publish-chart.outputs.digest }} \
184+
--certificate-identity "https://github.com/${{ github.workflow_ref }}" \
185+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq .
186+
187+
goreleaser:
188+
needs: [release-please, validate-versions]
189+
runs-on: ubuntu-latest
190+
permissions:
191+
contents: read # for actions/checkout to fetch code
192+
id-token: write # for Cosign to be able to sign release artifacts with GHA token
193+
if: "${{ needs.release-please.outputs.release_created }}"
194+
steps:
195+
- name: Checkout
196+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
197+
with:
198+
fetch-depth: 0
199+
- name: Setup Go
200+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
201+
with:
202+
go-version-file: go.mod
203+
- name: Include brew publishing
204+
run: cat .goreleaser.brew.yml >> .goreleaser.yml
205+
if: ${{ !contains(needs.release-please.outputs.version, '-') }}
206+
- name: Install cosign
207+
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3.9.1
208+
- name: Run GoReleaser
209+
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
210+
with:
211+
version: latest
212+
args: release --clean
213+
env:
214+
GITHUB_TOKEN: ${{ secrets.WEAVE_GITOPS_BOT_ACCESS_TOKEN }}
215+
BOT_TOKEN: ${{ secrets.WEAVE_GITOPS_BOT_ACCESS_TOKEN }}
216+
217+
create-release-summary:
218+
needs: [release-please, validate-versions, publish-npm-package, build-and-push-image, build-and-push-chart, goreleaser]
219+
runs-on: ubuntu-latest
220+
if: "${{ needs.release-please.outputs.release_created }}"
221+
steps:
222+
- name: Create release summary
223+
run: |
224+
echo "# 🚀 Release Summary" >> $GITHUB_STEP_SUMMARY
225+
echo "" >> $GITHUB_STEP_SUMMARY
226+
echo "**Version:** ${{ needs.release-please.outputs.version }}" >> $GITHUB_STEP_SUMMARY
227+
echo "**Tag:** ${{ needs.release-please.outputs.tag_name }}" >> $GITHUB_STEP_SUMMARY
228+
echo "" >> $GITHUB_STEP_SUMMARY
229+
echo "## 📦 Components Released" >> $GITHUB_STEP_SUMMARY
230+
echo "- ✅ Application binaries (GoReleaser)" >> $GITHUB_STEP_SUMMARY
231+
echo "- ✅ Container images (ghcr.io/weaveworks/wego-app)" >> $GITHUB_STEP_SUMMARY
232+
echo "- ✅ Helm chart (ghcr.io/weaveworks/charts)" >> $GITHUB_STEP_SUMMARY
233+
echo "- ✅ NPM package (@weaveworks scope)" >> $GITHUB_STEP_SUMMARY
234+
echo "" >> $GITHUB_STEP_SUMMARY
235+
echo "## 🔄 Version Synchronization" >> $GITHUB_STEP_SUMMARY
236+
echo "All components have been released with synchronized versions:" >> $GITHUB_STEP_SUMMARY
237+
echo "- Application: ${{ needs.release-please.outputs.version }}" >> $GITHUB_STEP_SUMMARY
238+
echo "- Chart AppVersion: ${{ needs.release-please.outputs.version }}" >> $GITHUB_STEP_SUMMARY
239+
echo "- Chart Version: $(echo '${{ needs.release-please.outputs.version }}' | sed 's/^v//')" >> $GITHUB_STEP_SUMMARY
240+
echo "- Image Tag: ${{ needs.release-please.outputs.version }}" >> $GITHUB_STEP_SUMMARY

‎.release-please-manifest.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
11
{
2-
".": "0.39.0-rc.2",
3-
"charts/gitops-server": "4.0.36"
2+
".": "0.39.0-rc.2"
43
}

‎charts/gitops-server/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ type: application
1313
# This is the chart version. This version number should be incremented each time you make changes
1414
# to the chart and its templates, including the app version.
1515
# Versions are expected to follow Semantic Versioning (https://semver.org/)
16-
version: 4.0.36
16+
version: 0.39.0-rc.2 # x-release-please-version
1717
# This is the version number of the application being deployed. This version number should be
1818
# incremented each time you make changes to the application. Versions are not expected to
1919
# follow Semantic Versioning. They should reflect the version the application is using.

0 commit comments

Comments
 (0)