ci: decouple chart publish from release-please#14
Conversation
Trigger publish on release: published instead of release-please outputs. This makes publishing per-chart and idempotent, and adds workflow_dispatch for manual recovery when a tag exists but the OCI push failed. Removes the publish job from release-please.yml; release-please now only opens release PRs and creates GitHub releases on merge.
📝 WalkthroughWalkthroughThis PR introduces a new GitHub Actions workflow for publishing Helm charts to GHCR as OCI artifacts on release events, with tag validation and component path resolution. It simultaneously removes step ID and outputs wiring from the release-please workflow, simplifying the release job configuration. ChangesHelm Chart Publishing Workflow
Release-Please Configuration Update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/publish.yml (1)
48-48: ⚡ Quick winUpdate pinned Helm version:
v4.1.4is a valid Helm release, but the latest stable version isv4.2.0(released May 14, 2026). Consider bumping the pinnedversion: v4.1.4in.github/workflows/publish.ymltov4.2.0to pick up fixes/security updates.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yml at line 48, Update the pinned Helm version in the GitHub Actions workflow by changing the value currently set as "version: v4.1.4" in .github/workflows/publish.yml to "v4.2.0" so the workflow uses the latest stable Helm release; locate the line containing the literal string version: v4.1.4 and replace it with version: v4.2.0.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 40-43: The Checkout step currently uses actions/checkout without
disabling credential persistence; update the step that uses
actions/checkout@de0fac2e... (the "Checkout" step) to add with:
persist-credentials: false (alongside any existing with keys like ref) so
credentials are not persisted to later steps.
- Line 28: The TAG assignment uses direct template expansion (TAG="${{
github.event.release.tag_name || inputs.tag }}") which allows shell template
injection; fix by moving the template result into the workflow environment and
then referencing that env var inside the shell step (e.g., define env: TAG: ${{
github.event.release.tag_name || inputs.tag }} for the job/step and in the run
use a safe expansion like TAG="$TAG" or printf '%s' "$TAG" so no template
content is re-interpreted by the shell), ensure the value is quoted and
validated against your regex after assigning from the env var.
---
Nitpick comments:
In @.github/workflows/publish.yml:
- Line 48: Update the pinned Helm version in the GitHub Actions workflow by
changing the value currently set as "version: v4.1.4" in
.github/workflows/publish.yml to "v4.2.0" so the workflow uses the latest stable
Helm release; locate the line containing the literal string version: v4.1.4 and
replace it with version: v4.2.0.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4eed3023-6079-42b8-b66e-994493ef96ed
📒 Files selected for processing (2)
.github/workflows/publish.yml.github/workflows/release-please.yml
💤 Files with no reviewable changes (1)
- .github/workflows/release-please.yml
| - name: Resolve tag | ||
| id: tag | ||
| run: | | ||
| TAG="${{ github.event.release.tag_name || inputs.tag }}" |
There was a problem hiding this comment.
Code injection vulnerability via template expansion in shell script.
Direct expansion of ${{ github.event.release.tag_name || inputs.tag }} into a bash assignment allows code injection before the validation regex runs. An attacker with write access could craft a tag like $(malicious-command) to execute arbitrary code.
Use an environment variable to prevent template expansion within the shell script.
🔒 Proposed fix to use environment variable
- name: Resolve tag
id: tag
+ env:
+ TAG: ${{ github.event.release.tag_name || inputs.tag }}
run: |
- TAG="${{ github.event.release.tag_name || inputs.tag }}"
if [[ ! "$TAG" =~ ^([a-z0-9-]+)-v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
echo "::error::Tag '$TAG' does not match expected format <component>-v<version>"As per static analysis hints, this was flagged as template-injection by zizmor.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 28-28: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 28-28: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml at line 28, The TAG assignment uses direct
template expansion (TAG="${{ github.event.release.tag_name || inputs.tag }}")
which allows shell template injection; fix by moving the template result into
the workflow environment and then referencing that env var inside the shell step
(e.g., define env: TAG: ${{ github.event.release.tag_name || inputs.tag }} for
the job/step and in the run use a safe expansion like TAG="$TAG" or printf '%s'
"$TAG" so no template content is re-interpreted by the shell), ensure the value
is quoted and validated against your regex after assigning from the env var.
| - name: Checkout | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| with: | ||
| ref: ${{ steps.tag.outputs.ref }} |
There was a problem hiding this comment.
Add persist-credentials: false to prevent credential leakage.
The checkout action persists credentials by default, which could be accessed by subsequent steps or malicious code in the repository. Since this workflow doesn't need to push commits, credentials should not be persisted.
🔒 Proposed fix to disable credential persistence
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ steps.tag.outputs.ref }}
+ persist-credentials: falseAs per static analysis hints, this was flagged as artipacked by zizmor.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ steps.tag.outputs.ref }} | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ steps.tag.outputs.ref }} | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 40-43: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 40 - 43, The Checkout step
currently uses actions/checkout without disabling credential persistence; update
the step that uses actions/checkout@de0fac2e... (the "Checkout" step) to add
with: persist-credentials: false (alongside any existing with keys like ref) so
credentials are not persisted to later steps.
There was a problem hiding this comment.
Pull request overview
This PR decouples Helm chart publishing from release-please by moving publishing into a dedicated workflow that runs when a GitHub Release is published (and can be rerun manually via workflow_dispatch). This aligns chart publishing with the actual release lifecycle and makes recovery possible by re-running the publish workflow for a specific tag.
Changes:
- Removed the chart publishing job and related outputs from the
release-pleaseworkflow. - Added a new
publish.ymlworkflow that publishes a single chart based on the released tag (<component>-v<version>) or a manually provided tag.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/release-please.yml | Removes the in-workflow publish job, leaving release creation to release-please. |
| .github/workflows/publish.yml | Adds a release-triggered + manually invokable workflow to package and push a chart to GHCR as an OCI artifact. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: read | ||
| packages: write | ||
| attestations: write | ||
| id-token: write |
Publish on
release: publishedinstead of release-please outputs. Per-chart, idempotent, and recoverable viaworkflow_dispatch.Summary by CodeRabbit
New Features
Chores