ci: block the openhands release PR on a red unstable E2E [ref PLTF-3540] #2209
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Preview Helm Charts | |
| # Publishes a per-PR preview chart to GHCR for every chart a PR changes, so the | |
| # change can be installed before it merges. release-please owns chart versions | |
| # now, so there is no manual version bump to gate on — a changed chart is enough. | |
| # | |
| # The preview version is the patch-bumped Chart.yaml version plus -alpha.<PR>, | |
| # e.g. with the last release at 0.7.68 a PR #812 preview is 0.7.69-alpha.812. | |
| # Patch-bumping keeps it ordered after the last stable release; the PR number | |
| # gives one moving preview tag per PR. | |
| on: | |
| pull_request: | |
| jobs: | |
| detect-changes: | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| crd-check: ${{ steps.changes.outputs.crd-check }} | |
| image-loader: ${{ steps.changes.outputs.image-loader }} | |
| openhands: ${{ steps.changes.outputs.openhands }} | |
| openhands-secrets: ${{ steps.changes.outputs.openhands-secrets }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect chart changes | |
| id: changes | |
| env: | |
| PR_BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: | | |
| BASE_REF="origin/${PR_BASE_REF}" | |
| echo "Comparing against: $BASE_REF" | |
| CHANGED_FILES=$(git diff --name-only "$BASE_REF"...HEAD) | |
| echo "Changed files:" | |
| echo "$CHANGED_FILES" | |
| # Embedded subcharts live under charts/openhands/charts/, so their | |
| # changes count as openhands changes via the ^charts/openhands/ match. | |
| for chart in crd-check image-loader openhands openhands-secrets; do | |
| if echo "$CHANGED_FILES" | grep -q "^charts/${chart}/"; then | |
| echo "${chart}=true" >> "$GITHUB_OUTPUT" | |
| echo "Changes detected in charts/${chart}" | |
| else | |
| echo "${chart}=false" >> "$GITHUB_OUTPUT" | |
| echo "No changes in charts/${chart}" | |
| fi | |
| done | |
| publish-charts: | |
| runs-on: ubuntu-24.04 | |
| needs: [detect-changes] | |
| permissions: | |
| contents: read | |
| packages: write | |
| defaults: | |
| run: | |
| shell: bash | |
| strategy: | |
| matrix: | |
| chart: | |
| - name: crd-check | |
| path: charts/crd-check | |
| - name: image-loader | |
| path: charts/image-loader | |
| - name: openhands | |
| path: charts/openhands | |
| - name: openhands-secrets | |
| path: charts/openhands-secrets | |
| max-parallel: 1 | |
| steps: | |
| - name: Check if this chart changed | |
| id: check | |
| env: | |
| CHANGES: ${{ toJSON(needs.detect-changes.outputs) }} | |
| CHART_NAME: ${{ matrix.chart.name }} | |
| run: | | |
| CHANGED=$(echo "$CHANGES" | jq -r --arg k "$CHART_NAME" '.[$k]') | |
| echo "should_publish=${CHANGED}" >> "$GITHUB_OUTPUT" | |
| if [ "$CHANGED" = "true" ]; then | |
| echo "✅ $CHART_NAME changed — will publish a preview" | |
| else | |
| echo "⏭️ $CHART_NAME unchanged — skipping" | |
| fi | |
| - name: Checkout | |
| if: steps.check.outputs.should_publish == 'true' | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| if: steps.check.outputs.should_publish == 'true' | |
| uses: azure/setup-helm@v3 | |
| with: | |
| version: 'v3.18.4' | |
| - name: Compute preview version | |
| if: steps.check.outputs.should_publish == 'true' | |
| id: version | |
| env: | |
| CHART_PATH: ${{ matrix.chart.path }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| BASE=$(yq '.version' "${CHART_PATH}/Chart.yaml") | |
| # Patch-bump so the preview sorts after the last stable release. | |
| NEXT=$(echo "$BASE" | awk -F. '{printf "%d.%d.%d", $1, $2, $3 + 1}') | |
| PREVIEW="${NEXT}-alpha.${PR_NUMBER}" | |
| echo "Base (last released): ${BASE} -> preview: ${PREVIEW}" | |
| yq -i ".version = \"${PREVIEW}\"" "${CHART_PATH}/Chart.yaml" | |
| echo "version=${PREVIEW}" >> "$GITHUB_OUTPUT" | |
| - name: Test ${{ matrix.chart.name }} chart with default values | |
| if: steps.check.outputs.should_publish == 'true' | |
| env: | |
| CHART_NAME: ${{ matrix.chart.name }} | |
| CHART_PATH: ${{ matrix.chart.path }} | |
| run: | | |
| echo "Updating dependencies for ${CHART_NAME}" | |
| helm dependency update "${CHART_PATH}" | |
| echo "Running helm lint for ${CHART_NAME}" | |
| helm lint "${CHART_PATH}" | |
| if grep -q '^type: library' "${CHART_PATH}/Chart.yaml"; then | |
| echo "Skipping helm template for library chart ${CHART_NAME}" | |
| else | |
| echo "Running helm template for ${CHART_NAME}" | |
| helm template "${CHART_PATH}" --debug | |
| fi | |
| - name: Prepare registry owner | |
| if: steps.check.outputs.should_publish == 'true' | |
| id: registry | |
| run: | | |
| REPO_OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]') | |
| echo "repo_owner=${REPO_OWNER}" >> "$GITHUB_OUTPUT" | |
| - name: Sanity-check the version is an alpha | |
| if: steps.check.outputs.should_publish == 'true' | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| if [[ "$VERSION" != *-alpha.* ]]; then | |
| echo "Refusing to publish: '$VERSION' is not an alpha version" | |
| exit 1 | |
| fi | |
| - name: Publish ${{ matrix.chart.name }} preview chart to GHCR | |
| if: steps.check.outputs.should_publish == 'true' | |
| uses: appany/helm-oci-chart-releaser@v0.4.2 | |
| with: | |
| name: ${{ matrix.chart.name }} | |
| repository: helm-charts | |
| path: ${{ matrix.chart.path }} | |
| registry: ghcr.io/${{ steps.registry.outputs.repo_owner }} | |
| registry_username: ${{ github.actor }} | |
| registry_password: ${{ secrets.GITHUB_TOKEN }} | |
| update_dependencies: 'true' | |
| tag: ${{ steps.version.outputs.version }} | |
| lint-and-test: | |
| runs-on: ubuntu-24.04 | |
| needs: [publish-charts] | |
| strategy: | |
| matrix: | |
| chart: | |
| - name: crd-check | |
| path: charts/crd-check | |
| - name: image-loader | |
| path: charts/image-loader | |
| - name: openhands | |
| path: charts/openhands | |
| - name: openhands-secrets | |
| path: charts/openhands-secrets | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v3 | |
| with: | |
| version: 'v3.18.4' | |
| - name: Lint ${{ matrix.chart.name }} chart | |
| env: | |
| CHART_NAME: ${{ matrix.chart.name }} | |
| CHART_PATH: ${{ matrix.chart.path }} | |
| run: | | |
| echo "Updating dependencies for ${CHART_NAME}" | |
| helm dependency update "${CHART_PATH}" | |
| echo "Running helm lint for ${CHART_NAME}" | |
| helm lint "${CHART_PATH}" | |
| - name: Template ${{ matrix.chart.name }} chart | |
| env: | |
| CHART_NAME: ${{ matrix.chart.name }} | |
| CHART_PATH: ${{ matrix.chart.path }} | |
| run: | | |
| if grep -q '^type: library' "${CHART_PATH}/Chart.yaml"; then | |
| echo "Skipping helm template for library chart ${CHART_NAME}" | |
| exit 0 | |
| fi | |
| echo "Running helm template for ${CHART_NAME}" | |
| helm template "${CHART_PATH}" --debug |