chore(helm): template Chart.yaml from Chart.yaml.tmpl

.drone.yml

@@ -63,6 +63,10 @@ steps:
   - name: helm-lint
     image: alpine/helm:3.16.4
     commands:
+      # Render Chart.yaml from Chart.yaml.tmpl. No DRONE_TAG on push events, so
+      # the script stamps a sentinel version — fine for lint/template since the
+      # rendered output is never published from this pipeline.
+      - sh scripts/render-charts.sh
       # Fetch subchart dependencies (postgresql, common) before lint/template
       - helm dependency build charts/helix-controlplane
       # Lint all three charts with default values
@@ -81,6 +85,14 @@ steps:
       - helm template test-release charts/helix-sandbox -f charts/helix-sandbox/values-eks.yaml > /dev/null
       - helm template test-release charts/helix-sandbox -f charts/helix-sandbox/values-gke.yaml > /dev/null
       - helm template test-release charts/helix-sandbox -f charts/helix-sandbox/values-aks.yaml > /dev/null
+      # Re-render with a synthetic real-looking tag and re-lint to catch
+      # template breakage that only surfaces with a non-sentinel version
+      # (the tag-build pipeline runs render-charts.sh with DRONE_TAG and we
+      # want to fail in PR rather than mid-release if substitution breaks).
+      - DRONE_TAG=v9.9.9-rendertest sh scripts/render-charts.sh
+      - helm lint charts/helix-controlplane
+      - helm lint charts/helix-runner
+      - helm lint charts/helix-sandbox
     when:
       event:
         - push

.gitignore

@@ -22,7 +22,14 @@ build-errors.log
 vendor
 */**/out.md
 charts/helix-controlplane/charts/*.tgz
-helix-runner
+# Chart.yaml is rendered from Chart.yaml.tmpl by scripts/render-charts.sh.
+# Source-of-truth is the .tmpl file; the rendered Chart.yaml is build output.
+charts/*/Chart.yaml
+# Anchor helix-runner to repo root so it does not shadow charts/helix-runner/.
+# Other unanchored patterns below (helix, zed-build, tmp) are left as-is to
+# avoid regressing the ignoring of build artifacts in subdirectories such as
+# api/cmd/helix/helix or runner-cmd/helix-runner/helix-runner.
+/helix-runner
 zed-build
 helix
 tmp

charts/helix-controlplane/Chart.yaml.tmpl

@@ -0,0 +1,32 @@
+apiVersion: v2
+name: helix-controlplane
+description: Helix ML Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+icon: https://helix.ml/logo.png
+
+# version and appVersion are stamped from the release tag at CI build time by
+# scripts/render-charts.sh. This template is the only file in git; Chart.yaml
+# is generated and gitignored. Do NOT install this chart from source — use the
+# published helm repo at https://charts.helixml.tech.
+version: __VERSION__
+appVersion: "__VERSION__"
+
+dependencies:
+  - condition: postgresql.enabled
+    name: postgresql
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 14.x.x
+  - name: common
+    repository: oci://registry-1.docker.io/bitnamicharts
+    tags:
+      - bitnami-common
+    version: 2.x.x

charts/helix-controlplane/README.md

@@ -1,4 +1,26 @@
 # Helix.ML on Kubernetes
 
+> **Do not install this chart from source.** `Chart.yaml` is generated from `Chart.yaml.tmpl` by CI at release time and is not committed to git — installing from a clone produces a chart with a sentinel version that won't match any release. Use the published Helm repository:
+>
+> ```
+> helm repo add helix https://charts.helixml.tech
+> helm install <release> helix/helix-controlplane
+> ```
+
 Please follow the instructions provided on our website to [install Helix.ML on
 Kubernetes](https://helix.ml/docs).
+
+## Developing on the chart
+
+`Chart.yaml` is generated from `Chart.yaml.tmpl` and gitignored, so `helm lint`
+and `helm template` will fail with `Chart.yaml file is missing` on a fresh
+clone. Render it first from the repo root:
+
+```bash
+sh scripts/render-charts.sh
+helm dependency build charts/helix-controlplane
+helm lint charts/helix-controlplane
+```
+
+Without `DRONE_TAG`/`TAG_NAME`, the script stamps a sentinel version that is
+fine for lint/template iteration but will not produce a usable release.

charts/helix-runner/Chart.yaml → charts/helix-runner/Chart.yaml.tmpl

@@ -13,13 +13,9 @@ description: Helix ML runner chart
 type: application
 icon: https://helix.ml/logo.png
 
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.3.9
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
-appVersion: "2.7.10"
+# version and appVersion are stamped from the release tag at CI build time by
+# scripts/render-charts.sh. This template is the only file in git; Chart.yaml
+# is generated and gitignored. Do NOT install this chart from source — use the
+# published helm repo at https://charts.helixml.tech.
+version: __VERSION__
+appVersion: "__VERSION__"

charts/helix-runner/README.md

@@ -1,23 +1,15 @@
 # HelixML runner on k8s
 
-Once you have the control-plane running, install the runner with the following command:
-
-```bash
-helm upgrade --install helix-runner \
-  ./helix-runner -f helix-runner/values.yaml \
-  -f helix-runner/values-example.yaml
-```
+> **Do not install this chart from source.** `Chart.yaml` is generated from `Chart.yaml.tmpl` by CI at release time and is not committed to git — installing from a clone produces a chart with a sentinel version that won't match any release. Use the published Helm repository below.
 
 ## Install from repository
 
+Once you have the control-plane running:
+
 ```bash
-helm repo add helix https://charts.helixml.tech 
+helm repo add helix https://charts.helixml.tech
 helm repo update
-```
-
-Then, install the runner:
 
-```bash
 helm upgrade --install helix-runner helix/helix-runner \
   --set runner.host="<host>" \
   --set runner.token="<token>" \
@@ -26,6 +18,20 @@ helm upgrade --install helix-runner helix/helix-runner \
 
 Set `replicaCount` to the number of runner pods you want to deploy. You can also target specific GPUs, e.g. `--set nodeSelector."nvidia\.com/gpu\.product"="NVIDIA-GeForce-RTX-3090-Ti"`
 
+## Developing on the chart
+
+`Chart.yaml` is generated from `Chart.yaml.tmpl` and gitignored, so `helm lint`
+and `helm template` will fail with `Chart.yaml file is missing` on a fresh
+clone. Render it first from the repo root:
+
+```bash
+sh scripts/render-charts.sh
+helm lint charts/helix-runner
+```
+
+Without `DRONE_TAG`/`TAG_NAME`, the script stamps a sentinel version that is
+fine for lint/template iteration but will not produce a usable release.
+
 ## Multi-GPU Support
 
 Each runner pod can manage multiple GPUs. Configure this with the `gpuCount` setting:

charts/helix-sandbox/Chart.yaml → charts/helix-sandbox/Chart.yaml.tmpl

@@ -8,11 +8,12 @@ description: |
 type: application
 icon: https://helix.ml/logo.png
 
-# Chart version - increment on changes to chart templates
-version: 0.2.2
-
-# Application version - matches helix-sandbox container version
-appVersion: "2.7.10"
+# version and appVersion are stamped from the release tag at CI build time by
+# scripts/render-charts.sh. This template is the only file in git; Chart.yaml
+# is generated and gitignored. Do NOT install this chart from source — use the
+# published helm repo at https://charts.helixml.tech.
+version: __VERSION__
+appVersion: "__VERSION__"
 
 keywords:
   - helix

scripts/gen_packages.sh

@@ -11,25 +11,8 @@ curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scrip
 chmod 700 get_helm.sh
 ./get_helm.sh
 
-# Stamp version and appVersion from release tag if available
-# Supports Drone CI (DRONE_TAG) and Google Cloud Build (TAG_NAME)
-# This aligns chart version with app version (like cert-manager) so releases
-# automatically publish new chart versions without manual bumps.
-RELEASE_TAG="${DRONE_TAG:-${TAG_NAME:-}}"
-# Strip leading 'v' if present (e.g. v2.7.11 -> 2.7.11)
-RELEASE_TAG="${RELEASE_TAG#v}"
-if [ -n "${RELEASE_TAG}" ]; then
-  # Helm chart version field requires valid semver
-  if ! echo "${RELEASE_TAG}" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
-    echo "ERROR: RELEASE_TAG '${RELEASE_TAG}' is not valid semver for chart version"
-    exit 1
-  fi
-  echo "Stamping version=${RELEASE_TAG} and appVersion=${RELEASE_TAG} into all Chart.yaml files"
-  for chart in charts/*/Chart.yaml; do
-    sed -i "s/^version:.*/version: ${RELEASE_TAG}/" "$chart"
-    sed -i "s/^appVersion:.*/appVersion: \"${RELEASE_TAG}\"/" "$chart"
-  done
-fi
+# Render Chart.yaml files from Chart.yaml.tmpl, stamping version from DRONE_TAG / TAG_NAME.
+sh scripts/render-charts.sh
 
 echo "Packaging charts from source code"
 mkdir -p temp

scripts/render-charts.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# Renders charts/*/Chart.yaml from charts/*/Chart.yaml.tmpl by stamping the
+# release version into the __VERSION__ placeholder.
+#
+# This chart source is NOT meant for direct installation. Install Helix from
+# the published helm repository:
+#
+#   helm repo add helix https://charts.helixml.tech
+#   helm install ... helix/helix-controlplane
+#
+# Render version is taken from ${DRONE_TAG} or ${TAG_NAME} (CI tag builds),
+# leading 'v' stripped. Without a tag, the script renders with a sentinel
+# version "0.0.0-source-not-installable" so any accidental local install
+# produces a chart that obviously isn't a real release.
+
+set -e
+
+VERSION="${DRONE_TAG:-${TAG_NAME:-}}"
+VERSION="${VERSION#v}"
+
+if [ -z "${VERSION}" ]; then
+  VERSION="0.0.0-source-not-installable"
+  echo "WARN: no DRONE_TAG/TAG_NAME set; rendering sentinel VERSION=${VERSION}." >&2
+  echo "WARN: this output is for CI lint/template use only — do NOT helm install from source." >&2
+  echo "WARN: real installs use https://charts.helixml.tech." >&2
+fi
+
+if ! echo "${VERSION}" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'; then
+  echo "ERROR: VERSION '${VERSION}' is not valid semver" >&2
+  exit 1
+fi
+
+echo "Rendering Chart.yaml files with VERSION=${VERSION}"
+
+for tmpl in charts/*/Chart.yaml.tmpl; do
+  [ -f "${tmpl}" ] || continue
+  out="${tmpl%.tmpl}"
+  sed "s/__VERSION__/${VERSION}/g" "${tmpl}" > "${out}"
+  echo "  ${out}"
+done

scripts/repo_sync.sh

@@ -5,24 +5,8 @@ set -e
 REPO_URL="https://charts.helixml.tech"
 
 function gen_packages() {
-  # Stamp version and appVersion from release tag if available
-  # This aligns chart version with app version (like cert-manager) so releases
-  # automatically publish new chart versions without manual bumps.
-  RELEASE_TAG="${DRONE_TAG:-${TAG_NAME:-}}"
-  # Strip leading 'v' if present (e.g. v2.7.11 -> 2.7.11)
-  RELEASE_TAG="${RELEASE_TAG#v}"
-  if [ -n "${RELEASE_TAG}" ]; then
-    # Helm chart version field requires valid semver
-    if ! echo "${RELEASE_TAG}" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
-      echo "ERROR: RELEASE_TAG '${RELEASE_TAG}' is not valid semver for chart version"
-      exit 1
-    fi
-    echo "Stamping version=${RELEASE_TAG} and appVersion=${RELEASE_TAG} into all Chart.yaml files"
-    for chart in charts/*/Chart.yaml; do
-      sed -i "s/^version:.*/version: ${RELEASE_TAG}/" "$chart"
-      sed -i "s/^appVersion:.*/appVersion: \"${RELEASE_TAG}\"/" "$chart"
-    done
-  fi
+  # Render Chart.yaml files from Chart.yaml.tmpl, stamping version from DRONE_TAG / TAG_NAME.
+  sh scripts/render-charts.sh
 
   echo "Packaging charts from source code"
   mkdir -p temp