Skip to content

Add crd only chart, that installs CRDs unconditionally #276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
notandy wants to merge 1 commit into
base: main
Choose a base branch
from
+61 −0
Open

Add crd only chart, that installs CRDs unconditionally #276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions .github/workflows/helm-crd-oci-package-ghcr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company
# SPDX-License-Identifier: Apache-2.0

name: Helm CRD OCI Package GHCR
"on":
push:
branches:
- main
paths:
- 'charts/openstack-hypervisor-operator/crds/**'
Comment on lines +6 to +10
Copy link

@coderabbitai coderabbitai bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Consider adding the CRD chart metadata to the path filter.

The current path filter only triggers when CRDs in the main chart change. Updates to the CRD-only chart metadata (e.g., charts/openstack-hypervisor-operator-crd/Chart.yaml) won't trigger this workflow, preventing you from publishing metadata-only updates.

📝 Proposed fix to include CRD chart metadata 
   push:
     branches:
       - main
     paths:
       - 'charts/openstack-hypervisor-operator/crds/**'
+      - 'charts/openstack-hypervisor-operator-crd/**'
   workflow_dispatch: {}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/helm-crd-oci-package-ghcr.yaml around lines 6 - 10, The
workflow's push path filter only watches
'charts/openstack-hypervisor-operator/crds/**' so updates to the CRD-only chart
metadata (e.g., charts/openstack-hypervisor-operator-crd/Chart.yaml) won't
trigger the job; update the paths array to also include the CRD-chart metadata
(for example add charts/openstack-hypervisor-operator-crd/** or at minimum
charts/openstack-hypervisor-operator-crd/Chart.yaml) so metadata-only changes to
the CRD chart will fire this workflow.

workflow_dispatch: {}
permissions:
contents: read
packages: write
jobs:
build-and-push-helm-crd-package:
name: Build and publish Helm CRD Chart OCI
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v6
- name: Install Helm
uses: azure/setup-helm@v4
- name: Sync CRDs from main chart
run: cp charts/openstack-hypervisor-operator/crds/*.yaml charts/openstack-hypervisor-operator-crd/templates/
- name: Lint Helm Chart
run: helm lint charts/openstack-hypervisor-operator-crd
- name: Package Helm Chart
run: |
# Use run number to auto-increment version on each CRD change
VERSION="1.0.${{ github.run_number }}"
echo "Running helm package with version $VERSION"
helm package charts/openstack-hypervisor-operator-crd --destination ./chart --version "$VERSION"
Comment on lines +28 to +33
Copy link

@coderabbitai coderabbitai bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

cat .github/workflows/helm-crd-oci-package-ghcr.yaml

Repository: cobaltcore-dev/openstack-hypervisor-operator

Length of output: 1673

🏁 Script executed:

# Check the overall structure and triggers of the workflow
head -50 .github/workflows/helm-crd-oci-package-ghcr.yaml

Repository: cobaltcore-dev/openstack-hypervisor-operator

Length of output: 1673

🏁 Script executed:

# Look for any CRD change detection logic in the workflow
grep -n "crd\|CRD\|paths\|on:" .github/workflows/helm-crd-oci-package-ghcr.yaml

Repository: cobaltcore-dev/openstack-hypervisor-operator

Length of output: 733

Address the risk of versioning without actual code changes via workflow_dispatch.

The workflow correctly triggers on CRD file changes via the paths filter for push events. However, workflow_dispatch: {} allows manual triggering that increments the version without any code changes. This defeats the stated goal of "auto-versioned whenever a CRD changes."

Consider either:

  1. Removing workflow_dispatch: {} to ensure versions only increment on actual CRD changes
  2. Adding manual inputs to workflow_dispatch (e.g., a confirmation or changelog) to enforce intentionality
  3. Using git-based versioning (commit SHA, tags) for better traceability to the actual CRD state

The current approach of github.run_number is adequate for sequencing within this workflow's push context, but the manual dispatch loophole should be closed.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/helm-crd-oci-package-ghcr.yaml around lines 32 - 37, The
workflow allows manual runs via workflow_dispatch which will still increment
VERSION="1.0.${{ github.run_number }}" without CRD changes; either remove the
workflow_dispatch trigger, or make it require deliberate input (e.g., a
confirmation or changelog input) before proceeding, or change the VERSION
derivation used in the helm package step (the VERSION variable and the helm
package charts/openstack-hypervisor-operator-crd --version "$VERSION"
invocation) to be based on a git-derived identifier (commit SHA or tag) so
manual dispatches do not silently advance the CRD package version; implement one
of these fixes and ensure the workflow gate checks the new input or uses git
metadata before running the helm package step.

- name: Log in to the Container registry
uses: docker/login-action@v4
with:
password: ${{ secrets.GITHUB_TOKEN }}
registry: ghcr.io
username: ${{ github.actor }}
- name: Push Helm Chart to ghcr.io
run: helm push ./chart/*.tgz oci://ghcr.io/${{ github.repository_owner }}/charts
14 changes: 14 additions & 0 deletions charts/openstack-hypervisor-operator-crd/.helmignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
# Patterns to ignore when building packages.
.DS_Store
*.swp
*.bak
*.tmp
*~
.git
.gitignore
.bzr
.bzrignore
.hg
.hgignore
.svn
.empty
6 changes: 6 additions & 0 deletions charts/openstack-hypervisor-operator-crd/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
apiVersion: v2
name: openstack-hypervisor-operator-crd
description: CRDs for the OpenStack Hypervisor Operator
appVersion: latest
version: 1.0.0
type: application
Empty file added charts/openstack-hypervisor-operator-crd/templates/.empty
View file
Open in desktop
Empty file.
Loading