OSAC-2182: remove push:tags trigger from umbrella publish-charts workflow

[eliorerz]

Summary

• publish-charts.yaml triggered on both push: tags: ['v*'] and workflow_dispatch
• The umbrella chart is meant to be published only via workflow_dispatch with explicit per-component version inputs
• A bare tag push (e.g. tagging osac-installer for version tracking after a release, as the /osac-release skill does) independently retriggers the same workflow with no inputs — the "Resolve versions" step then defaults every component version to the umbrella version number
• This has already failed twice in production: runs 28554120530 (tag v0.0.4) and 28470564460 (tag v0.0.3), both failing with could not download oci://.../fulfillment-service:0.0.4: not found — because it tried to pull fulfillment-service at the umbrella's version instead of its real version
• Worse case: if a component version ever coincides with the umbrella version, the tag-push run would succeed silently, republishing the umbrella chart with wrong dependency pins and overwriting the correct release with no failed CI run to flag it

Changes

• Removed the push: tags: ['v*'] trigger — workflow is now workflow_dispatch-only
• Removed the now-unreachable tag-push version-defaulting logic in the "Resolve versions" step (all component version inputs are required: true for workflow_dispatch, so this branch could never execute safely anyway)

Test plan

• Confirm workflow_dispatch runs with explicit component versions still work as before
• Confirm pushing a v* tag to osac-installer no longer triggers publish-charts.yaml

Fixes OSAC-2182.

Summary by CodeRabbit

• Chores
  • Publishing charts now runs only when started manually.
  • Component chart versions must be provided explicitly during the run, improving version consistency for published charts.

[openshift-ci-robot]

@eliorerz: This pull request references OSAC-2182 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• publish-charts.yaml triggered on both push: tags: ['v*'] and workflow_dispatch
• The umbrella chart is meant to be published only via workflow_dispatch with explicit per-component version inputs
• A bare tag push (e.g. tagging osac-installer for version tracking after a release, as the /osac-release skill does) independently retriggers the same workflow with no inputs — the "Resolve versions" step then defaults every component version to the umbrella version number
• This has already failed twice in production: runs 28554120530 (tag v0.0.4) and 28470564460 (tag v0.0.3), both failing with could not download oci://.../fulfillment-service:0.0.4: not found — because it tried to pull fulfillment-service at the umbrella's version instead of its real version
• Worse case: if a component version ever coincides with the umbrella version, the tag-push run would succeed silently, republishing the umbrella chart with wrong dependency pins and overwriting the correct release with no failed CI run to flag it

Changes

• Removed the push: tags: ['v*'] trigger — workflow is now workflow_dispatch-only
• Removed the now-unreachable tag-push version-defaulting logic in the "Resolve versions" step (all component version inputs are required: true for workflow_dispatch, so this branch could never execute safely anyway)

Test plan

• Confirm workflow_dispatch runs with explicit component versions still work as before
• Confirm pushing a v* tag to osac-installer no longer triggers publish-charts.yaml

Fixes OSAC-2182.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eliorerz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [eliorerz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: cc3ae1c5-dcac-4591-b3db-4157bd7a4071

📥 Commits

Reviewing files that changed from the base of the PR and between 7275ab1 and bc11ab7.

📒 Files selected for processing (1)

• .github/workflows/publish-charts.yaml

---

Walkthrough

The publish-charts workflow no longer triggers on git tag pushes; it now runs only via manual workflow_dispatch. The version resolution script always requires component versions from workflow_dispatch inputs, removing the previous fallback to the umbrella chart version.

Changes

Publish Workflow Trigger and Version Resolution

Layer / File(s)	Summary
Remove tag trigger .github/workflows/publish-charts.yaml	The push trigger with tags: v* is removed from on:, leaving only workflow_dispatch to trigger the workflow.
Remove fallback version logic .github/workflows/publish-charts.yaml	Comment updated to state component versions always come from workflow_dispatch inputs; logic that defaulted to the umbrella version when inputs were absent is removed, so validation now runs directly on required inputs.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• osac-project/osac-installer#394: Also modifies .github/workflows/publish-charts.yaml's component version resolution logic, related to how component versions are used at publish time.

Suggested reviewers: adriengentil, rgolangh

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing the push-tag trigger from the umbrella publish-charts workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets found; workflow only references GitHub-provided secrets.GITHUB_TOKEN and has no literal API keys/passwords or embedded credentials.
No-Weak-Crypto	✅ Passed	PR only edits a Helm workflow trigger/version fallback; no MD5/SHA1/DES/RC4/ECB, custom crypto, or secret/token comparisons were added.
No-Injection-Vectors	✅ Passed	Diff only removes the tag trigger and fallback logic; no new SQL/shell/eval/yaml-load/innerHTML sinks were introduced.
Container-Privileges	✅ Passed	Changed file is only .github/workflows/publish-charts.yaml; diff removes tag trigger and version fallback, with no privileged/hostNetwork/root settings present.
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive data is logged: outputs are version strings and chart/value files; GITHUB_TOKEN is piped to helm login, not echoed.
Ai-Attribution	✅ Passed	PR-range is one commit; its message has no AI-tool mention and no Co-Authored-By trailer. Only Signed-off-by is present.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eliorerz]

/retest

[github-actions]

No failed workflow runs found for this PR at commit bc11ab7.

[eliorerz]

/retest

[github-actions]

No failed workflow runs found for this PR at commit bc11ab7.