[rmcdaniel]

Review tier B: a release-record version bump that crosses native schema versions. Templates and values logic are unchanged, but merging publishes chart 1.1.0, and every existing native install upgrading to it needs a backed-up schema-upgrade.

This pairs chart 1.1.0 with native Server 3.3.2. It's the chart step #1009 planned for 3.1.0, done now for the current release:

• Tag: 3.3.2 (lightweight) → 660217dd1ac62701eb1fc26b08fbbaf825e777d1 (git ls-remote).
• Image index: sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912, resolved anonymously on docker.io/durableworkflow/server:3.3.2 and ghcr.io/durable-workflow/server:3.3.2 (amd64 and arm64). It matches the release notes (release run 42591612884).
• GitHub Release: 3.3.2 is published and Latest.

Same shape as #1000 (chart 1.0.3 / 3.0.5), but a minor chart bump: the Server crosses 3.1, 3.2 and 3.3, and the UPGRADING semver rules require a chart minor for that.

Schema path documented

Server	MySQL, MariaDB, PostgreSQL schema	Source
3.0.5 (chart 1.0.3)	8	VERSION in rust/src/runtime/{postgres,mysql}.rs at tag 3.0.5
3.1.0	8	3.1.0 release record; same constants at tag 3.1.0
3.2.0	10	constants at tag 3.2.0; 3.3.0 notes ("10 → 11")
3.3.0–3.3.2	11	3.3.0/3.3.1/3.3.2 notes; constants at tag 3.3.2

At 3.3.2, schema-upgrade has steps from 8 for all three backends: 9 adds workflow_tasks.ready_origin_at, 10 adds indexes on dw_query_cache and dw_poll_receipts, and 11 adds the scoped dispatch index. The 3.3.0 notes also say version 8 databases are upgraded by the same command. The chart refuses SQLite, so the SQLite caveats in the notes don't apply.

Change

• resources/release/source-release.json: helm_chart moves to 1.1.0, with app_version 3.3.2.
• Regenerated by node scripts/ci/sync-source-release.mjs --write: Chart.yaml (version, appVersion, dev.durable-workflow.image-reference), the values.yaml image tag and the README example.
• Hand-written:
  • artifacthub.io/changes: the default image change, the required schema upgrade, and the 3.1.0 and 3.3.0 additions. It also lists the 3.3.0–3.3.2 internal query changes, without claiming a speedup.
  • A "Chart 1.1.0 / Server 3.3.2" section in docs/UPGRADING.md:
    • the schema table, and the fact that 3.3.2 refuses a version 8 database with native_schema_upgrade_required;
    • the 1.0.x → 1.1.0 procedure: scale to zero on the current chart, back up the database, then helm upgrade --version 1.1.0 with native.schemaUpgrade.enabled=true. GitOps and offline renders use the README's manual Job instead;
    • Helm's --timeout (default 5m, which covers hook Jobs per helm upgrade --help) and native.schemaUpgrade.activeDeadlineSeconds (1800), which both need raising if the index build is slow;
    • PostgreSQL's plain CREATE INDEX, which blocks writes to workflow_tasks. Every Server is already stopped, so the build time adds to the downtime;
    • MySQL/MariaDB resuming an interrupted upgrade (native_schema_upgrade_incomplete meanwhile);
    • rollback only by restoring the backup, because 3.0.x and 3.2.x refuse schema 11 with native_schema_newer_than_binary, so a helm rollback to a 1.0.x revision with Servers won't start.
  • Runtime changes 3.1.0 → 3.3.2, taken from the 3.1.0 release record and the 3.3.0, 3.3.1 and 3.3.2 notes, with the open known limitations (Intermittent ready-age cold poll replay refusal after native restart (MariaDB restarts lane) #1096, and MySQL json columns round JSON doubles in history; store JSON losslessly (3.2.0) #1016 from 3.1.0).
• Not documented: 3.2.0 has no release notes (tag only, no docs/releases/3.2.0.md). The section says so and relies only on its schema version. It doesn't summarize 3.2.0 changes from commit titles.
• Templates, values.schema.json, the values contract and workflows are byte-unchanged.

Checked locally (exact head)

• sync-source-release.mjs --check: consumers are synchronized for Helm chart 1.1.0 (host Node 22.22.1).
• helm_chart_release.py check-version --base-ref origin/main: the packaged chart advances 1.0.3 → 1.1.0.
• test_helm_chart_release.py: 30 tests OK.
• test-source-release.mjs: 2 pass. The third needs php, which isn't installed on this host; CI runs it, as on Chart 1.0.3: default to native Server 3.0.5 #1000.
• Chart.yaml parses, and artifacthub.io/changes parses as a 5-entry YAML list.
• Helm 3.16.3, in a disposable offline alpine/helm container with the chart mounted read-only:
  • helm lint passes, with and without ci/native-inline-secrets-values.yaml;
  • helm template with ci/native-inline-secrets-values.yaml and with ci/native-ingress-and-hpa-values.yaml renders docker.io/durableworkflow/server:3.3.2, helm.sh/chart: durable-workflow-1.1.0 and app.kubernetes.io/version: "3.3.2";
  • with native.schemaUpgrade.enabled=true, helm template is refused as designed: plain, as an install/offline render, and with --is-upgrade, because lookup can't see the live Deployment. The hook itself wasn't exercised against a cluster here.
• Chart 1.1.0 isn't yet in ghcr.io/durable-workflow/charts/durable-workflow (anonymous manifest GET: 404; 1.0.3: 200).
• Diff: exactly Chart.yaml, README, docs/UPGRADING.md, values.yaml and source-release.json.

Publication on merge

Merging pushes chart paths to main, which triggers Helm Chart Release (helm-chart-release.yml). It validates the protected source and calls helm-chart-publish.yml, which:

• builds the package once with the exact source revision;
• proves docker.io/durableworkflow/server:3.3.2 resolves anonymously;
• refuses changed content under an existing version;
• pushes the immutable oci://ghcr.io/durable-workflow/charts/durable-workflow:1.1.0;
• removes registry credentials, then verifies an anonymous pull and a clean-client kind install.

The kind install is a fresh install at schema 11. It doesn't exercise the 8 → 11 upgrade path. After publication, the chart tuple (OCI manifest digest, package digest, source commit and qualification run) goes to Security's readback and to General's docs pairing (helm_chart.app_version 3.3.2).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Published and read back: Helm Chart Release run 42644498343 succeeded (lint/render, chart-testing kind install, publish + verify). An anonymous helm show chart oci://ghcr.io/durable-workflow/charts/durable-workflow --version 1.1.0 returns digest sha256:fd670cad2d12453f5d9923bacaec2ab6fba02ff7fe82570eee8f01f66bf73e89, version 1.1.0, appVersion 3.3.2, image reference docker.io/durableworkflow/server:3.3.2 and source revision 0eea994a. Next: the docs manifest pairing (server 3.3.2 / chart 1.1.0).

[rmcdaniel]

Readback addendum: chart package digest sha256:a72dc4fda8a1c8913d19ad6611558e938a74c6dc109dd973a8bfcbce799c2e5d. It comes from helm-release-evidence.json (chart.package_digest) in run 42644498343's evidence artifact, matches the run's anonymous-install log line, and equals the single chart layer of OCI manifest sha256:fd670cad…. Source commit 0eea994a7f4796ceaec536604c7bd48af11124e2.