mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-08-09 22:38:46 +00:00
f3e4e5f8f0
* ci(helm): publish chart to charts/ namespace prefix on GHCR
Push the Helm chart to ghcr.io/<owner>/charts/deer-flow (via a `charts/`
prefix on the `helm push` target) instead of the bare `deer-flow`
package. This namespaces the chart apart from the image packages
(deer-flow-{backend,frontend,provisioner}) without renaming the chart:
Chart.yaml `name` stays `deer-flow`, so dir = chart name = in-cluster
resource/selector names, and no `nameOverride` hack is needed.
The chart is new in 2.1.0 (chart infra landed in #3987, after v2.0.0),
so 2.1.0 is the first chart release. Early nightly builds remain at the
legacy non-prefixed ghcr.io/<owner>/deer-flow.
Also refresh chart release docs:
- Replace the removed scripts/build-and-push.sh in the chart README with
raw `docker build`/`push` commands (contexts/args match container.yaml).
- Point NOTES.txt's empty-registry warning at the README section instead
of the removed script.
- Retarget RELEASING.md version examples from 2.2.0 to 2.1.0.
- Bump the chart README's helm prerequisite to 3+.
* docs(helm): require helm 3.8+ and note legacy chart package cleanup
Address PR #4175 review:
- bump documented minimum to helm 3.8 (OCI registry support stabilized
there; earlier 3.x needs HELM_EXPERIMENTAL_OCI=1)
- add a post-release note to delete/revoke the legacy bare
ghcr.io/<owner>/deer-flow chart package after 2.1.0
88 lines
3.4 KiB
YAML
88 lines
3.4 KiB
YAML
name: Publish Helm Chart
|
|
|
|
# Publishes the DeerFlow Helm chart as an OCI artifact to GHCR alongside the
|
|
# container images (see container.yaml). Triggers on the same `v*` tags.
|
|
#
|
|
# On pull requests touching the chart or config.example.yaml, `validate-chart`
|
|
# runs lint + template render + a config_version drift check (the chart's
|
|
# embedded config_version must not lag config.example.yaml) so a broken or
|
|
# stale chart fails the PR, not the release.
|
|
#
|
|
# Users then install with:
|
|
# helm install deer-flow oci://ghcr.io/${{ owner }}/charts/deer-flow --version <ver>
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
pull_request:
|
|
paths:
|
|
- "deploy/helm/deer-flow/**"
|
|
- "config.example.yaml"
|
|
- ".github/workflows/chart.yaml"
|
|
- "scripts/check_config_version.sh"
|
|
|
|
jobs:
|
|
validate-chart:
|
|
# Runs on PRs and release tags: catch a broken render or a stale
|
|
# config_version before merge / publish. A broken chart published under a
|
|
# vX.Y.Z tag is an immutable OCI artifact (GHCR won't let you overwrite
|
|
# --version), so a regression must fail here, not on install.
|
|
if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
|
|
|
|
# ubuntu-latest ships with helm 3 preinstalled - no setup-helm action needed.
|
|
- name: Lint chart
|
|
run: helm lint deploy/helm/deer-flow
|
|
- name: Validate templates render
|
|
run: helm template deer-flow deploy/helm/deer-flow --include-crds >/dev/null
|
|
|
|
# The chart's `config:` block embeds a config_version that must not fall
|
|
# behind config.example.yaml. A stale version is silent in-cluster (the
|
|
# image ships no example to compare against, so _check_config_version
|
|
# never warns) but means the chart's config is authored against an older
|
|
# schema. Bump it in values.yaml and the README example. config_version
|
|
# gates no runtime behavior - it only drives the outdated-warning - so a
|
|
# bare version bump needs no field changes. Logic lives in
|
|
# scripts/check_config_version.sh (shared with nightly.yaml).
|
|
- name: config_version drift check
|
|
run: bash scripts/check_config_version.sh
|
|
|
|
verify-versions:
|
|
# Gate the release: every version source must match the v* tag. A forgotten
|
|
# bump in Chart.yaml, pyproject.toml, or package.json fails here and skips
|
|
# the publish. See scripts/verify_versions.sh.
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: ./.github/workflows/verify-versions.yml
|
|
|
|
publish-chart:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
needs: [verify-versions, validate-chart]
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
|
|
|
|
- name: Log in to GHCR
|
|
run: |
|
|
echo "${{ secrets.GITHUB_TOKEN }}" | \
|
|
helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
|
|
|
|
- name: Package chart
|
|
run: helm package deploy/helm/deer-flow --destination ./packages
|
|
|
|
- name: Push chart to GHCR
|
|
run: |
|
|
for pkg in ./packages/*.tgz; do
|
|
echo "--- pushing $pkg"
|
|
helm push "$pkg" oci://ghcr.io/${{ github.repository_owner }}/charts
|
|
done
|