From 90c0762c50e2c97f4505ebc9596ae9f2cb4a3ce4 Mon Sep 17 00:00:00 2001
From: ChenXing Yang <20001020ycx@gmail.com>
Date: Wed, 22 Jul 2026 11:24:59 -0700
Subject: [PATCH 1/3] feat(helm): Add workflow for publishing the Helm chart to
 GitHub Pages.

---
 .github/workflows/code-linting-checks.yaml |   3 -
 .github/workflows/spider-helm.yaml         | 120 +++++++++++++++++++++
 taskfile.yaml                              |   1 +
 taskfiles/helm.yaml                        |  19 ++++
 4 files changed, 140 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/spider-helm.yaml
 create mode 100644 taskfiles/helm.yaml

diff --git a/.github/workflows/code-linting-checks.yaml b/.github/workflows/code-linting-checks.yaml
index a4bd4f956..dd28033b9 100644
--- a/.github/workflows/code-linting-checks.yaml
+++ b/.github/workflows/code-linting-checks.yaml
@@ -38,7 +38,6 @@ jobs:
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
-          fetch-depth: 0
           submodules: "recursive"
 
       - uses: "./tools/yscope-dev-utils/exports/github/actions/install-python"
@@ -54,8 +53,6 @@ jobs:
 
       - run: "task lint:yml-check"
 
-      - run: "task lint:check-helm"
-
   lint-cpp:
     needs: "filter-relevant-changes"
     if: >-
diff --git a/.github/workflows/spider-helm.yaml b/.github/workflows/spider-helm.yaml
new file mode 100644
index 000000000..9440bb920
--- /dev/null
+++ b/.github/workflows/spider-helm.yaml
@@ -0,0 +1,120 @@
+name: "spider-helm"
+
+on:
+  pull_request:
+    paths: &monitored_paths
+      - ".github/workflows/spider-helm.yaml"
+      - "taskfile.yaml"
+      - "taskfiles/**"
+      - "tools/deployment/spider-helm/**"
+      - "tools/yscope-dev-utils"
+  push:
+    paths: *monitored_paths
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: "${{github.workflow}}-${{github.ref}}"
+
+  # Cancel in-progress jobs for efficiency. Exclude the `main` branch to allow uninterrupted
+  # publishing of Helm charts.
+  cancel-in-progress: "${{github.ref != 'refs/heads/main'}}"
+
+jobs:
+  lint:
+    runs-on: "ubuntu-latest"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          submodules: "recursive"
+
+          # Fetch all history for all branches; otherwise, `helm lint` would complain about not
+          # finding the `origin/main` branch.
+          fetch-depth: 0
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-python"
+        with:
+          version: "3.10"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - name: "Lint Helm charts"
+        shell: "bash"
+        run: "task lint:check-helm"
+
+  publish:
+    # Publish from `main` and `spider-huntsman-vA.B.C` release branches.
+    if: >-
+      github.event_name != 'pull_request'
+      && (github.ref == 'refs/heads/main'
+      || startsWith(github.ref, 'refs/heads/spider-huntsman-v'))
+    needs: "lint"
+    runs-on: "ubuntu-latest"
+    permissions:
+      # To push to the `gh-pages` branch.
+      contents: "write"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          persist-credentials: false
+          submodules: "recursive"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - name: "Package Helm chart"
+        shell: "bash"
+        run: "task helm:package"
+
+      - name: "Checkout branch `gh-pages`"
+        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          path: "gh-pages"
+          ref: "gh-pages"
+
+      - name: "Get chart version"
+        id: "get-chart-version"
+        uses: "mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8"  # v4.50.1
+        with:
+          cmd: "yq '.version' 'tools/deployment/spider-helm/Chart.yaml'"
+
+      - name: "Update Helm repository"
+        id: "update-helm-repo"
+        shell: "bash"
+        run: |-
+          chart_tgz="spider-${{steps.get-chart-version.outputs.result}}.tgz"
+
+          # Skip if this chart version already exists.
+          if [[ -f "gh-pages/${chart_tgz}" ]]; then
+            echo "Chart ${chart_tgz} already exists, skipping publish."
+            echo "skip_publish=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          cp "build/spider-helm"/*.tgz "gh-pages/"
+
+          # Update index.yaml, merging with existing index if present.
+          . "build/toolchains/helm/env"
+          url="${{github.server_url}}/${{github.repository}}/raw/gh-pages"
+          if [[ -f "gh-pages/index.yaml" ]]; then
+            helm repo index "gh-pages" --merge "gh-pages/index.yaml" --url "${url}"
+          else
+            helm repo index "gh-pages" --url "${url}"
+          fi
+
+      - name: "Push to gh-pages branch"
+        if: "steps.update-helm-repo.outputs.skip_publish != 'true'"
+        shell: "bash"
+        working-directory: "gh-pages"
+        run: |-
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+          git add "*.tgz" "index.yaml"
+          commit_message="ci(helm): Publish spider-${{steps.get-chart-version.outputs.result}}"
+          commit_message+=" from ${{github.ref_name}} (${{github.sha}})."
+          git commit -m "$commit_message"
+          git push
diff --git a/taskfile.yaml b/taskfile.yaml
index ae3002fed..fc2159414 100644
--- a/taskfile.yaml
+++ b/taskfile.yaml
@@ -7,6 +7,7 @@ includes:
   deps: "taskfiles/deps.yaml"
   docker: "taskfiles/docker.yaml"
   docs: "taskfiles/docs.yaml"
+  helm: "taskfiles/helm.yaml"
   lint: "taskfiles/lint.yaml"
   test: "taskfiles/test.yaml"
   utils: "tools/yscope-dev-utils/exports/taskfiles/utils/utils.yaml"
diff --git a/taskfiles/helm.yaml b/taskfiles/helm.yaml
new file mode 100644
index 000000000..f0f9ea584
--- /dev/null
+++ b/taskfiles/helm.yaml
@@ -0,0 +1,19 @@
+version: "3"
+
+includes:
+  toolchains: "toolchains.yaml"
+
+vars:
+  G_SPIDER_HELM_BUILD_DIR: "{{.G_BUILD_DIR}}/spider-helm"
+
+tasks:
+  package:
+    vars:
+      OUTPUT_DIR: "{{.G_SPIDER_HELM_BUILD_DIR}}"
+    deps: ["toolchains:helm"]
+    cmds:
+      - "rm -rf '{{.OUTPUT_DIR}}'"
+      - "mkdir -p '{{.OUTPUT_DIR}}'"
+      - |-
+        . "{{.G_HELM_TOOLCHAIN_ENV_FILE}}"
+        helm package "{{.ROOT_DIR}}/tools/deployment/spider-helm" --destination "{{.OUTPUT_DIR}}"

From 3e6699708a6e90413b837f6269d44f79073b2b9d Mon Sep 17 00:00:00 2001
From: ChenXing Yang <60459812+20001020ycx@users.noreply.github.com>
Date: Thu, 23 Jul 2026 11:53:23 -0700
Subject: [PATCH 2/3] Apply suggestions from code review

Co-authored-by: Junhao Liao <junhao@junhao.ca>
---
 .github/workflows/code-linting-checks.yaml |  2 +-
 .github/workflows/spider-helm.yaml         | 18 +++++++++++++-----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/code-linting-checks.yaml b/.github/workflows/code-linting-checks.yaml
index dd28033b9..7c24a38e7 100644
--- a/.github/workflows/code-linting-checks.yaml
+++ b/.github/workflows/code-linting-checks.yaml
@@ -36,7 +36,7 @@ jobs:
   lint-common:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
           submodules: "recursive"
 
diff --git a/.github/workflows/spider-helm.yaml b/.github/workflows/spider-helm.yaml
index 9440bb920..81ab730c4 100644
--- a/.github/workflows/spider-helm.yaml
+++ b/.github/workflows/spider-helm.yaml
@@ -19,13 +19,17 @@ concurrency:
 
   # Cancel in-progress jobs for efficiency. Exclude the `main` branch to allow uninterrupted
   # publishing of Helm charts.
-  cancel-in-progress: "${{github.ref != 'refs/heads/main'}}"
+  cancel-in-progress: >-
+    ${{
+      github.ref != 'refs/heads/main'
+      && !startsWith(github.ref, 'refs/heads/spider-huntsman-v')
+    }}
 
 jobs:
   lint:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
           submodules: "recursive"
 
@@ -53,12 +57,16 @@ jobs:
       || startsWith(github.ref, 'refs/heads/spider-huntsman-v'))
     needs: "lint"
     runs-on: "ubuntu-latest"
+    concurrency:
+      group: "${{github.workflow}}-gh-pages"
+      cancel-in-progress: false
     permissions:
       # To push to the `gh-pages` branch.
       contents: "write"
     steps:
-      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
+          persist-credentials: false
           persist-credentials: false
           submodules: "recursive"
 
@@ -71,14 +79,14 @@ jobs:
         run: "task helm:package"
 
       - name: "Checkout branch `gh-pages`"
-        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
           path: "gh-pages"
           ref: "gh-pages"
 
       - name: "Get chart version"
         id: "get-chart-version"
-        uses: "mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8"  # v4.50.1
+        uses: "mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d"  # v4.53.3
         with:
           cmd: "yq '.version' 'tools/deployment/spider-helm/Chart.yaml'"
 

From b19650a5408df82db87afdc659fdf863f97b09b0 Mon Sep 17 00:00:00 2001
From: ChenXing Yang <20001020ycx@gmail.com>
Date: Thu, 23 Jul 2026 11:57:04 -0700
Subject: [PATCH 3/3] fix(ci): Remove duplicated persist-credentials key from
 the publish checkout.

---
 .github/workflows/spider-helm.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/spider-helm.yaml b/.github/workflows/spider-helm.yaml
index 81ab730c4..0a8148e27 100644
--- a/.github/workflows/spider-helm.yaml
+++ b/.github/workflows/spider-helm.yaml
@@ -66,7 +66,6 @@ jobs:
     steps:
       - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
         with:
-          persist-credentials: false
           persist-credentials: false
           submodules: "recursive"