feat(helm): Add workflow for publishing the Helm chart to GitHub Pages.

[20001020ycx]

Description

This PR adds a GitHub Actions workflow to lint and publish the Spider Helm chart to a GitHub Pages-backed Helm repository (https://github.com/y-scope/spider/raw/gh-pages), so that downstream charts (e.g., CLP's) can consume it as a dependency via helm dependency update instead of vendoring a copy of the chart through http download.

Note for reviewer:

The implementation mirrors CLP's proven chart-publishing workflow: clp-package-helm.yaml but adapted to this repo's conventions. The change is mostly following y-scope/clp#1891's implementation.

Note for Spider maintainers:

One-time setup required:

The publish job checks out the gh-pages branch, which doesn't exist yet. It must be created once (as an empty orphan branch) before the first publish:

git switch --orphan gh-pages
git commit --allow-empty -m "ci(helm): Initialize Helm repository branch."
git push origin gh-pages

After the first publish, the repository is consumable via:

helm repo add spider https://github.com/y-scope/spider/raw/gh-pages
helm search repo spider --versions

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

Note

The checks below were run against the fork 20001020ycx/spider at this PR's head commit, with gh-pages created there per the maintainers' note above.

1. Pushing to main publishes the chart to gh-pages

1. Create the one-time gh-pages branch, then fast-forward the fork's main to this PR's head commit.

   git switch --orphan gh-pages
   git commit --allow-empty -m "ci(helm): Initialize Helm repository branch."
   git push origin gh-pages
   git push origin <this PR's head commit>:main

   Expected: the push triggers a spider-helm run on main in which lint and publish both succeed (fork run).

2. helm dependency update downloads the chart from the repository

1. Declare the published chart as a dependency of a scratch parent chart, then resolve it.

   mkdir fake-parent && cat > fake-parent/Chart.yaml <<'EOF'
   apiVersion: "v2"
   name: "fake-parent"
   version: "0.1.0"
   dependencies:
     - name: "spider"
       version: "0.1.2"
       repository: "https://github.com/20001020ycx/spider/raw/gh-pages"
       condition: "spider.enabled"
   EOF
   helm dependency update fake-parent

   Expected: Downloading spider from repo https://github.com/20001020ycx/spider/raw/gh-pages; fake-parent/charts/spider-0.1.2.tgz appears; fake-parent/Chart.lock pins digest: sha256:f12a4bd42da43a0e4a89acef7d3f879891127fb8b2e42f6ea1b74b88243eefe4.

2. Verify the downloaded subchart renders through the parent and honors its condition gate.

   helm template test fake-parent --set spider.enabled=true | grep -c '^# Source: fake-parent/charts/spider/'   # -> 8
   helm template test fake-parent --set spider.enabled=false | grep -c '^# Source:'   # -> 0

3. Verify helm dependency build reproduces charts/ from Chart.lock alone.

   rm -rf fake-parent/charts
   helm dependency build fake-parent
   ls fake-parent/charts   # -> spider-0.1.2.tgz

Summary by CodeRabbit

Summary by CodeRabbit

• New Features

  • Added a dedicated workflow to lint, package, and publish the Spider Helm chart.
  • Added Helm chart packaging automation and publishing to the chart repository (including index updates) for eligible releases.

• Bug Fixes

  • Updated CI linting flow so Helm validation runs via the dedicated Helm workflow.

[coderabbitai]

Warning

Review limit reached

@20001020ycx, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6ccca23c-7d3e-43ae-8a00-00cb9a77ea0e

📥 Commits

Reviewing files that changed from the base of the PR and between 90c0762 and b19650a.

📒 Files selected for processing (2)

• .github/workflows/code-linting-checks.yaml
• .github/workflows/spider-helm.yaml

Walkthrough

Adds Helm chart packaging and publication automation, introduces a dedicated Helm lint workflow, wires Helm tasks into the root Taskfile, and removes Helm linting from the common lint workflow.

Changes

Helm chart publishing

Layer / File(s)	Summary
Helm package task taskfile.yaml, taskfiles/helm.yaml	The root Taskfile includes Helm tasks, and the new package task builds the spider-helm chart into the configured output directory.
Workflow triggers and lint validation .github/workflows/spider-helm.yaml	A dedicated workflow adds path-filtered triggers, restricted permissions, concurrency controls, and a lint job for the Helm chart.
Chart publication to gh-pages .github/workflows/spider-helm.yaml	The publish job packages the chart, avoids duplicate archives, updates index.yaml, and pushes chart artifacts to gh-pages.
Existing lint workflow adjustment .github/workflows/code-linting-checks.yaml	The common lint job retains recursive submodules, removes the explicit full-history checkout setting, and no longer runs Helm linting.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant HelmPackageTask
  participant GhPages
  GitHubActions->>HelmPackageTask: Run Helm package task
  HelmPackageTask->>GitHubActions: Produce chart archive
  GitHubActions->>GhPages: Check archive and index.yaml
  GitHubActions->>GhPages: Copy chart and push updated index

Loading

Possibly related PRs

• y-scope/spider#383: Introduced the Helm lint task and its Helm toolchain setup used by this workflow.
• y-scope/spider#4: Modified the common lint workflow changed here.
• y-scope/spider#13: Modified the common lint job’s workflow step sequence.

Suggested reviewers: sitaowang1998

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a workflow to publish the Helm chart to GitHub Pages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/spider-helm-publish.yaml:
- Around line 28-34: Set persist-credentials to false on both checkout steps in
the publish workflow: the checkout with submodules and fetch-depth settings and
the checkout in the publish job. Leave the later gh-pages checkout unchanged
because it requires credentials for git push.
- Around line 82-117: Replace direct GitHub expression interpolation in the
“Update Helm repository” and “Push to gh-pages branch” run scripts with
step-level env variables, then reference those variables as quoted shell data
for the chart version, ref name, and commit SHA. Use the existing GITHUB_SHA
environment variable for the SHA instead of templating it, and update chart_tgz
and commit_message construction accordingly.
- Around line 49-54: Replace the broad startsWith release-branch condition in
the publish job’s if gate with a script-based validation of GITHUB_REF_NAME,
allowing only main or branches matching ^v[0-9]+\.[0-9]+\.[0-9]+$. Ensure the
script exposes the validation result as a step output and use that output to
prevent invalid branches from publishing.
- Around line 17-22: Update the workflow-level concurrency block to use one
shared group for all gh-pages publishing runs instead of incorporating
github.ref, and exclude both main and v* release refs from cancel-in-progress.
Preserve cancellation for other branches so publish jobs are serialized across
main and release branches and protected from mid-push cancellation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: de6e9bf5-9956-4712-9225-6e29b047f585

📥 Commits

Reviewing files that changed from the base of the PR and between f56c3a0 and 4b47a5a.

📒 Files selected for processing (4)

• .github/workflows/code-linting-checks.yaml
• .github/workflows/spider-helm-publish.yaml
• taskfile.yaml
• taskfiles/helm.yaml

💤 Files with no reviewable changes (1)

• .github/workflows/code-linting-checks.yaml

[sitaowang1998]

LGTM. @LinZhihao-723 Could you create the new gh-pages branch? I don't have permission to do this.

[hoophalab]

lgtm. nitpicks