OSAC-1409: Read component versions from Chart.yaml on tag push

.github/workflows/helm-lint.yaml

@@ -27,7 +27,11 @@ jobs:
       uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f  # v2.8.0
 
     - name: Build chart dependencies
-      run: helm dependency build charts/osac/
+      run: |
+        # Chart.yaml has real published versions for the release workflow, but
+        # file:// deps require versions to match the submodule Chart.yaml (0.0.0).
+        yq -i '(.dependencies[].version) = "0.0.0"' charts/osac/Chart.yaml
+        helm dependency build charts/osac/
 
     - name: Run chart-testing lint
       run: ct lint --all --config ct.yaml

.github/workflows/integration-tests.yml

@@ -38,7 +38,11 @@ jobs:
         kubectl wait --for=condition=Available deployment/cert-manager-cainjector -n cert-manager --timeout=120s
 
     - name: Build chart dependencies
-      run: helm dependency build charts/osac/
+      run: |
+        # Chart.yaml has real published versions for the release workflow, but
+        # file:// deps require versions to match the submodule Chart.yaml (0.0.0).
+        yq -i '(.dependencies[].version) = "0.0.0"' charts/osac/Chart.yaml
+        helm dependency build charts/osac/
 
     - name: Lint chart
       run: helm lint charts/osac/

.github/workflows/publish-charts.yaml

@@ -7,26 +7,26 @@ on:
         description: 'Chart version (without v prefix, e.g. 0.0.1). Defaults to git tag.'
         required: false
       operator_crds_version:
-        description: 'osac-operator-crds chart version (e.g. 0.0.1)'
-        required: true
+        description: 'osac-operator-crds chart version (e.g. 0.0.1). Defaults to Chart.yaml.'
+        required: false
       operator_version:
-        description: 'osac-operator chart version (e.g. 0.0.1)'
-        required: true
+        description: 'osac-operator chart version (e.g. 0.0.1). Defaults to Chart.yaml.'
+        required: false
       service_version:
-        description: 'fulfillment-service chart version (e.g. 0.0.64)'
-        required: true
+        description: 'fulfillment-service chart version (e.g. 0.0.64). Defaults to Chart.yaml.'
+        required: false
       aap_version:
-        description: 'osac-aap chart version (e.g. 0.0.3)'
-        required: true
+        description: 'osac-aap chart version (e.g. 0.0.3). Defaults to Chart.yaml.'
+        required: false
       bmf_crds_version:
-        description: 'bare-metal-fulfillment-operator-crds chart version (e.g. 0.0.1)'
-        required: true
+        description: 'bare-metal-fulfillment-operator-crds chart version (e.g. 0.0.1). Defaults to Chart.yaml.'
+        required: false
       bmf_version:
-        description: 'bare-metal-fulfillment-operator chart version (e.g. 0.0.1)'
-        required: true
+        description: 'bare-metal-fulfillment-operator chart version (e.g. 0.0.1). Defaults to Chart.yaml.'
+        required: false
       ui_version:
-        description: 'osac-ui chart version (e.g. 0.0.1)'
-        required: true
+        description: 'osac-ui chart version (e.g. 0.0.1). Defaults to Chart.yaml.'
+        required: false
 
 concurrency:
   group: publish-charts-${{ github.ref }}
@@ -83,7 +83,7 @@ jobs:
           exit 1
         fi
 
-        # Component versions: always from workflow_dispatch inputs (all required)
+        # Component versions: from inputs, or read from Chart.yaml
         crds_ver="${INPUT_CRDS_VERSION}"
         operator_ver="${INPUT_OPERATOR_VERSION}"
         service_ver="${INPUT_SERVICE_VERSION}"
@@ -92,6 +92,29 @@ jobs:
         bmf_ver="${INPUT_BMF_VERSION}"
         ui_ver="${INPUT_UI_VERSION}"
 
+        # When no inputs provided, read versions from Chart.yaml
+        if [ -z "${crds_ver}" ]; then
+          crds_ver="$(yq '.dependencies[] | select(.name == "osac-operator-crds") | .version' charts/osac/Chart.yaml)"
+        fi
+        if [ -z "${operator_ver}" ]; then
+          operator_ver="$(yq '.dependencies[] | select(.name == "osac-operator") | .version' charts/osac/Chart.yaml)"
+        fi
+        if [ -z "${service_ver}" ]; then
+          service_ver="$(yq '.dependencies[] | select(.name == "fulfillment-service") | .version' charts/osac/Chart.yaml)"
+        fi
+        if [ -z "${aap_ver}" ]; then
+          aap_ver="$(yq '.dependencies[] | select(.name == "osac-aap") | .version' charts/osac/Chart.yaml)"
+        fi
+        if [ -z "${bmf_crds_ver}" ]; then
+          bmf_crds_ver="$(yq '.dependencies[] | select(.name == "bare-metal-fulfillment-operator-crds") | .version' charts/osac/Chart.yaml)"
+        fi
+        if [ -z "${bmf_ver}" ]; then
+          bmf_ver="$(yq '.dependencies[] | select(.name == "bare-metal-fulfillment-operator") | .version' charts/osac/Chart.yaml)"
+        fi
+        if [ -z "${ui_ver}" ]; then
+          ui_ver="$(yq '.dependencies[] | select(.name == "osac-ui") | .version' charts/osac/Chart.yaml)"
+        fi
+
         # Validate all component versions
         for pair in "osac-operator-crds:${crds_ver}" "osac-operator:${operator_ver}" "fulfillment-service:${service_ver}" "osac-aap:${aap_ver}" "bare-metal-fulfillment-operator-crds:${bmf_crds_ver}" "bare-metal-fulfillment-operator:${bmf_ver}" "osac-ui:${ui_ver}"; do
           name="${pair%%:*}"

charts/osac/Chart.yaml

@@ -6,19 +6,19 @@ version: 0.0.1
 
 dependencies:
   - name: osac-operator-crds
-    version: ">=0.0.0"
+    version: "0.0.2"
     repository: "file://../../base/osac-operator/charts/operator-crds"
     alias: operatorCrds
   - name: osac-operator
-    version: ">=0.0.0"
+    version: "0.0.2"
     repository: "file://../../base/osac-operator/charts/operator"
     alias: operator
   - name: fulfillment-service
-    version: ">=0.0.0"
+    version: "0.0.65"
     repository: "file://../../base/osac-fulfillment-service/charts/service"
     alias: service
   - name: osac-aap
-    version: ">=0.0.0"
+    version: "0.0.4"
     repository: "file://../../base/osac-aap/charts/aap"
     alias: aap
   - name: bare-metal-fulfillment-operator-crds

docs/releasing.md

@@ -0,0 +1,133 @@
+# Releasing a New Version
+
+This document describes how to publish new OSAC Helm chart versions to the OCI
+registry at `oci://ghcr.io/osac-project/charts`.
+
+## Overview
+
+OSAC consists of four component charts and one umbrella chart:
+
+| Chart | Source repo | Registry path |
+|---|---|---|
+| fulfillment-service | osac-project/fulfillment-service | `oci://ghcr.io/osac-project/charts/fulfillment-service` |
+| osac-operator | osac-project/osac-operator | `oci://ghcr.io/osac-project/charts/osac-operator` |
+| osac-operator-crds | osac-project/osac-operator | `oci://ghcr.io/osac-project/charts/osac-operator-crds` |
+| osac-aap | osac-project/osac-aap | `oci://ghcr.io/osac-project/charts/osac-aap` |
+| osac (umbrella) | osac-project/osac-installer | `oci://ghcr.io/osac-project/charts/osac` |
+
+Each repo has a `publish-charts.yaml` GitHub Actions workflow triggered by `v*`
+tag pushes. Chart.yaml files in component repos use `version: 0.0.0` as a
+placeholder — the real version is injected at publish time from the git tag.
+
+## Publishing component charts
+
+### 1. Determine the next version
+
+```bash
+cd /path/to/<component-repo>
+git fetch upstream --tags
+git tag --sort=-v:refname | head -5
+```
+
+### 2. Tag and push
+
+Tag `upstream/main` to ensure you're tagging the latest merged code:
+
+```bash
+git tag v<version> upstream/main
+git push upstream v<version>
+```
+
+The `publish-charts.yaml` workflow triggers automatically.
+
+> **Note:** osac-operator publishes **two** charts (osac-operator and
+> osac-operator-crds) from a single tag push.
+
+### 3. Verify
+
+```bash
+# Check workflow status
+gh run list --repo osac-project/<repo> --limit 3
+
+# Verify chart is pullable
+helm pull oci://ghcr.io/osac-project/charts/<chart-name> --version <version>
+```
+
+For fulfillment-service, also verify the GitHub Release was created by
+goreleaser:
+
+```bash
+gh release view v<version> --repo osac-project/fulfillment-service
+```
+
+## Publishing the umbrella chart
+
+The umbrella chart bundles all component charts. Its publish workflow reads
+component versions from `charts/osac/Chart.yaml` and rewrites the `file://`
+dependency repositories to OCI references at publish time.
+
+> **Note:** `Chart.yaml` uses `file://` repositories for local development and
+> CI. Local builds (lint, integration, setup.sh) reset dependency versions to
+> `0.0.0` before `helm dependency build` so they match the submodule charts.
+> The publish workflow reads the real versions and rewrites to OCI.
+
+### 1. Update dependency versions in Chart.yaml
+
+Before publishing, update the dependency versions in `charts/osac/Chart.yaml`
+to match the published component chart versions:
+
+```yaml
+dependencies:
+  - name: osac-operator-crds
+    version: "0.0.1"          # ← published component version
+    repository: "file://../../base/osac-operator/charts/operator-crds"
+    alias: operatorCrds
+  # ... repeat for each dependency
+```
+
+Commit and merge this change before tagging.
+
+### 2a. Publish via tag push
+
+```bash
+cd /path/to/osac-installer
+git tag v<version> upstream/main
+git push upstream v<version>
+```
+
+The umbrella chart version comes from the tag. Component versions are read from
+`charts/osac/Chart.yaml`.
+
+### 2b. Publish via workflow dispatch
+
+All inputs are optional — omitted component versions fall back to
+`charts/osac/Chart.yaml`. The `version` input falls back to the git ref/tag name:
+
+```bash
+gh workflow run publish-charts.yaml \
+  --repo osac-project/osac-installer \
+  -f version=<umbrella-version> \
+  -f operator_crds_version=<version> \
+  -f operator_version=<version> \
+  -f service_version=<version> \
+  -f aap_version=<version>
+```
+
+This is useful for testing a new component version without committing to
+`Chart.yaml` first.
+
+### 3. Verify
+
+```bash
+helm pull oci://ghcr.io/osac-project/charts/osac --version <version>
+```
+
+## Tips
+
+- Always tag `upstream/main`, not a local branch
+- If a tag already exists, delete it first:
+  `git tag -d v<version> && git push upstream :refs/tags/v<version>`
+- The publish workflows replace `tag: latest` with `tag: v<version>` in
+  values.yaml — this requires the source values.yaml to use `tag: latest`
+- Keep `charts/osac/Chart.yaml` dependency versions up to date — they are the
+  source of truth for tag-based umbrella releases

scripts/setup.sh

@@ -28,6 +28,13 @@ echo "Namespace: ${INSTALLER_NAMESPACE}"
 echo "Setup phase: ${SETUP_PHASE}"
 echo ""
 
+# Helm mode requires yq to patch Chart.yaml dependency versions
+if [[ "${DEPLOY_MODE}" == "helm" ]] && ! command -v yq &>/dev/null; then
+    echo "ERROR: yq is required for Helm deploy mode but was not found in PATH." >&2
+    echo "  Install it from https://github.com/mikefarah/yq" >&2
+    exit 1
+fi
+
 if [[ "${SETUP_PHASE}" == "all" || "${SETUP_PHASE}" == "prerequisites" ]]; then
 
 # Optionally install LVMS as storage service (must be before keycloak which needs a default storage class)
@@ -334,6 +341,9 @@ echo "Deploying OSAC using Helm..."
 CLUSTER_DOMAIN=$(oc get ingresses.config/cluster -o jsonpath='{.spec.domain}')
 EXTERNAL_HOSTNAME="fulfillment-api-${INSTALLER_NAMESPACE}.${CLUSTER_DOMAIN}"
 INTERNAL_HOSTNAME="fulfillment-internal-api-${INSTALLER_NAMESPACE}.${CLUSTER_DOMAIN}"
+# Chart.yaml has real published versions for the release workflow, but
+# file:// deps require versions to match the submodule Chart.yaml (0.0.0).
+yq -i '(.dependencies[].version) = "0.0.0"' charts/osac/Chart.yaml
 helm dependency update charts/osac/
 helm upgrade --install osac charts/osac/ \
     --namespace "${INSTALLER_NAMESPACE}" \