helm: add oci release for charts

[DrFaust92]

Checklist for the toolset:

• Toolset has unit tests where relevant
• Toolset has both ask_holmes and investigate evals
• Toolset has a documentation PR opened against the robusta repo
• Toolset has the correct is_default flag
• Toolset returns a correct get_example_config
• Toolset does a live health check in addition to checking for correct configuration
• Create a demo video (if relevant)

similar to robusta-dev/robusta#1954

Summary by CodeRabbit

• Chores
  • Enhanced deployment workflow with improved container registry integration and security enhancements for artifact distribution.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

The GitHub Actions workflow is updated to add authentication to GitHub Container Registry and enable pushing Helm charts to GHCR's OCI registry. Workflow permissions are expanded to include write access to packages and id-tokens, with new docker login and helm package/push steps integrated into the build pipeline.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Configuration .github/workflows/build-docker-images.yaml	Added workflow permissions for packages: write and id-token: write; introduced docker login step for ghcr.io authentication; added helm package and helm push steps to deploy charts to OCI registry at ghcr.io

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• PR #964: Both PRs modify .github/workflows/build-docker-images.yaml—one adds GHCR/Helm OCI authentication and chart push, while the other updates Docker action versions and image build/push logic.

Suggested reviewers

• moshemorad

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'helm: add oci release for charts' clearly and concisely describes the main change: adding OCI release support for Helm charts in the GitHub workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between daedf3f and 0a47d77.

📒 Files selected for processing (1)

• .github/workflows/build-docker-images.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: llm_evals
• GitHub Check: build (3.12)
• GitHub Check: build (3.10)
• GitHub Check: build (3.11)

🔇 Additional comments (2)

.github/workflows/build-docker-images.yaml (2)

12-15: LGTM! Permissions are correctly configured.

The added permissions (packages: write and id-token: write) are appropriate for pushing Helm charts to GHCR and for the existing OIDC authentication with Google Cloud.

---

88-92: The Helm chart packaging and OCI registry push implementation is correctly configured. The helm package command will generate holmes-${{github.ref_name}}.tgz, which matches the expected filename in the push command. GHCR authentication is properly set up before the push step with appropriate permissions (packages: write), and the Chart.yaml version is correctly updated during the workflow.

No code-level issues identified.

[arikalon1]

Thanks for the PR @DrFaust92