mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-26 21:26:39 +00:00
db9b0b4bf0
* fix(release): reject a stale backend/uv.lock in the version gate verify_versions.sh compared only Chart.yaml, pyproject.toml and package.json, so bumping those three by hand passed the v* gate while backend/uv.lock still recorded the previous root package version. The backend image installs with uv sync --locked, so the chart and the other images published while the backend image failed to build. Run uv lock --check in backend/ as part of the gate, letting uv own the PEP 440 normalization, and fail when uv is missing. The reusable verify-versions workflow installs the uv version the backend image pins. * docs(changelog): reference #6588 * fix(release): explain an unparsed lock version and stop blaming the lock for every uv failure Print a fallback when the lock's root entry is not found, so the job log does not show an empty field, and word the uv lock --check annotation so a network error or uv crash is not reported as a stale lock.
110 lines
4.6 KiB
YAML
110 lines
4.6 KiB
YAML
name: Publish Helm Chart
|
|
|
|
# Publishes the DeerFlow Helm chart as an OCI artifact to GHCR alongside the
|
|
# container images (see container.yaml). Triggers on the same `v*` tags.
|
|
#
|
|
# On pull requests touching the chart or config.example.yaml, `validate-chart`
|
|
# runs lint + template render + a sandbox Service-type gating check + a
|
|
# config_version drift check (the chart's embedded config_version must not lag
|
|
# config.example.yaml) so a broken or stale chart fails the PR, not the release.
|
|
#
|
|
# Users then install with:
|
|
# helm install deer-flow oci://ghcr.io/${{ owner }}/charts/deer-flow --version <ver>
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
pull_request:
|
|
paths:
|
|
- "deploy/helm/deer-flow/**"
|
|
- "config.example.yaml"
|
|
- ".github/workflows/chart.yaml"
|
|
- "scripts/check_config_version.sh"
|
|
- "scripts/check_chart_sandbox_service.sh"
|
|
- "scripts/check_chart_sandbox_storage.sh"
|
|
- "scripts/check_chart_skill_upload_size.sh"
|
|
|
|
jobs:
|
|
validate-chart:
|
|
# Runs on PRs and release tags: catch a broken render or a stale
|
|
# config_version before merge / publish. A broken chart published under a
|
|
# vX.Y.Z tag is an immutable OCI artifact (GHCR won't let you overwrite
|
|
# --version), so a regression must fail here, not on install.
|
|
if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
|
|
|
|
# ubuntu-latest ships with helm 3 preinstalled - no setup-helm action needed.
|
|
- name: Lint chart
|
|
run: helm lint deploy/helm/deer-flow
|
|
- name: Validate templates render
|
|
run: helm template deer-flow deploy/helm/deer-flow --include-crds >/dev/null
|
|
|
|
# Assert the sandbox Service-type gating: default emits
|
|
# SANDBOX_SERVICE_TYPE=ClusterIP and no NODE_HOST; the NodePort opt-in
|
|
# emits both. Guards the #3929 default flip against regressions.
|
|
- name: Validate sandbox Service-type gating
|
|
run: bash scripts/check_chart_sandbox_service.sh
|
|
|
|
# Gateway-generated skill projections are sent to the provisioner as
|
|
# paths under DEER_FLOW_HOST_BASE_DIR. With the shared home PVC enabled,
|
|
# both components must use the same logical root so those paths can be
|
|
# translated into PVC subPaths instead of being rejected as out-of-base.
|
|
- name: Validate sandbox storage path contract
|
|
run: bash scripts/check_chart_sandbox_storage.sh
|
|
|
|
# Keep the rendered Ingress aligned with the Gateway's .skill upload
|
|
# size, streaming, and long-running validation requirements.
|
|
- name: Validate skill upload ingress policy
|
|
run: bash scripts/check_chart_skill_upload_size.sh
|
|
|
|
# The chart's `config:` block embeds a config_version that must not fall
|
|
# behind config.example.yaml. A stale version is silent in-cluster (the
|
|
# image ships no example to compare against, so _check_config_version
|
|
# never warns) but means the chart's config is authored against an older
|
|
# schema. Bump it in values.yaml and the README example. config_version
|
|
# gates no runtime behavior - it only drives the outdated-warning - so a
|
|
# bare version bump needs no field changes. Logic lives in
|
|
# scripts/check_config_version.sh (shared with nightly.yaml).
|
|
- name: config_version drift check
|
|
run: bash scripts/check_config_version.sh
|
|
|
|
verify-versions:
|
|
# Gate the release: every version source must match the v* tag. A forgotten
|
|
# bump in Chart.yaml, pyproject.toml, or package.json, or a stale
|
|
# backend/uv.lock, fails here and skips the publish. See
|
|
# scripts/verify_versions.sh.
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: ./.github/workflows/verify-versions.yml
|
|
|
|
publish-chart:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
needs: [verify-versions, validate-chart]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
|
|
|
|
- name: Log in to GHCR
|
|
run: |
|
|
echo "${{ secrets.GITHUB_TOKEN }}" | \
|
|
helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
|
|
|
|
- name: Package chart
|
|
run: helm package deploy/helm/deer-flow --destination ./packages
|
|
|
|
- name: Push chart to GHCR
|
|
run: |
|
|
for pkg in ./packages/*.tgz; do
|
|
echo "--- pushing $pkg"
|
|
helm push "$pkg" oci://ghcr.io/${{ github.repository_owner }}/charts
|
|
done
|