From 139f9372f78ce701c9db4d51a02d7c84cc762ad5 Mon Sep 17 00:00:00 2001
From: Brad DerManouelian <bderman@gmail.com>
Date: Tue, 8 Sep 2026 00:16:52 -0500
Subject: [PATCH] feat(release): publish the Helm chart alongside the self-host
 images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nothing published the chart. Every version so far went up by hand, which
is how it drifted to 0.1.1 while the app reached 1.0.0 — and why 1.0.0 had
to be pushed manually after the release was already out.

Package and push it from merge-manifests, after the images it references
exist, so a chart is never published pointing at images that failed to
build.

version and appVersion are stamped from the release tag rather than read
from Chart.yaml, so the published chart cannot disagree with the release
it deploys. Chart.yaml keeps its own values for local `helm template` and
`helm lint`; only the published artifact is stamped.
---
 .github/workflows/release-selfhost.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/.github/workflows/release-selfhost.yml b/.github/workflows/release-selfhost.yml
index d314a635b..4e57e8b7e 100644
--- a/.github/workflows/release-selfhost.yml
+++ b/.github/workflows/release-selfhost.yml
@@ -168,3 +168,28 @@ jobs:
         else
           echo "Skipping 'latest' — $VERSION is not the newest release"
         fi
+
+    # The Helm chart ships from here too, after the images it references exist.
+    # Publishing it by hand is what let the chart drift to 0.1.1 while the app
+    # reached 1.0.0.
+    - name: Set up Helm
+      uses: azure/setup-helm@v4
+
+    - name: Package and publish the Helm chart
+      run: |
+        VERSION="${{ github.event.inputs.tag || github.ref_name }}"; VERSION_NUM="${VERSION#v}"
+
+        # version and appVersion are set from the release tag rather than read
+        # from Chart.yaml, so the published chart can never disagree with the
+        # release it deploys. Chart.yaml keeps its own values for local `helm
+        # template`/`lint`; only the published artifact is stamped here.
+        helm package testplanit/helm/testplanit \
+          --version "${VERSION_NUM}" \
+          --app-version "${VERSION_NUM}" \
+          -d "${RUNNER_TEMP}"
+
+        echo "${{ secrets.GITHUB_TOKEN }}" | \
+          helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+        helm push "${RUNNER_TEMP}/testplanit-${VERSION_NUM}.tgz" \
+          "oci://ghcr.io/${OWNER_LC}/charts"