Skip to content

fix(helm): restore tagged-but-unpublished chart versions automatically - #75

Closed
tim-thacker-nullify wants to merge 1 commit into
fix/helm-publish-review-r2from
fix/helm-publish-review-r3
Closed

tim-thacker-nullify wants to merge 1 commit into
fix/helm-publish-review-r2from
fix/helm-publish-review-r3

Conversation

@tim-thacker-nullify

@tim-thacker-nullify tim-thacker-nullify commented Sep 14, 2026 •

Copy link
Copy Markdown
Member

Claude

Stacked on #70. Round-3 review fixes. Since #70 tags versions before deploy-pages, a failed deploy left every PR's validate red until someone dispatched recovery by hand.

  • validate, publish-dry-run and release all set HELM_REPO_RECOVER_FROM_RELEASES=true:
    • The next release on main restores a version that is tagged but missing from the index. It uses the existing checks: the tag is on main, the asset matches the chart re-packaged from the tag, and legacy 0.2.0 matches its pinned digest.
    • validate emits a ::warning:: for that version instead of failing.
    • A version that fails any of those checks still stops the build.
  • Removed the recover_from_releases dispatch input, which nothing reads now. The github-pages environment approval on release is unchanged.
  • A new version's existing release asset is compared by contents (same_contents), not by the digest of a fresh helm package, which is never byte-identical.
    • The asset is first checked against its recorded digest; a download or digest failure still skips the chart.
    • On a match the site serves the asset's bytes, so the tag step's digest check agrees.
  • Recovery finds the chart directory at the tag by Chart.yaml name (chart_dir_at), instead of assuming helm-charts/<name>.

Healing needs a release run on main: the next push that touches Helm paths, a re-run of the failed run, or a manual dispatch.

Not exercised in CI: recovery against a real missing version, and the asset-contents branch, which is reachable only through a draft release that carries an asset.

🤖 Generated with Claude Code


View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

- Every workflow job sets HELM_REPO_RECOVER_FROM_RELEASES=true, so a version
  tagged before a failed deploy is restored by the next release on main, and
  validate reports it as a ::warning:: instead of failing. Recovery still
  requires the tag on main, the asset to match the chart re-packaged from the
  tag, and legacy 0.2.0's pinned digest; a version failing any check stops the
  build. The recover_from_releases dispatch input is removed; the github-pages
  environment approval is unchanged.
- A new version whose release already has a tgz asset is compared by contents
  instead of by the digest of a fresh helm package, which never matches, and the
  site then serves the asset's bytes. An asset that cannot be downloaded or does
  not match its recorded digest still skips the chart.
- Recovery finds the chart directory at the tag by Chart.yaml name instead of
  assuming the directory is named after the chart.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@tim-thacker-nullify

Copy link
Copy Markdown
Member Author

Claude

Collapsed into #60 at 1bb74ce after passing adversarial review; all of this PR's commits are now in #60.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant