feat(ci): opt-in Helm chart publish in airgap-build workflow

Adds workflow_dispatch input `publish_chart` (default false). When true
and the run is a full build (variant=both, platforms=both, no
tag_override), a new phase 5 runs after the image push and:

1. Reads the old appVersion + chart version from Chart.yaml
2. Auto-bumps the chart patch version (X.Y.Z -> X.Y.(Z+1)) and
   replaces the old HASH with the new HASH across Chart.yaml,
   examples/values-openshift-airgapped.yaml, README.md, README-he.md
3. Commits as github-actions[bot] with
   "chore(helm): bump chart X.Y.Z, appVersion <HASH>" and pushes
4. helm package + helm push to oci://registry-1.docker.io/<user>
5. Writes a summary section with version delta and install command

Patch-only by design — non-patch bumps remain manual per BUILD.md
step 5 (the user opts out by leaving publish_chart=false and runs the
chart push by hand). Skipped automatically on partial builds and
override tags since those are testing flows that should not produce a
chart release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: EliShteinman

.github/workflows/airgap-build.yml

@@ -41,6 +41,15 @@ on:
           normal builds.
         type: string
         default: ''
+      publish_chart:
+        description: >-
+          After the image push, also auto-bump the Helm chart (patch version
+          + appVersion -> new HASH), commit to this branch, and push the
+          chart as OCI artifact. Only runs on full builds (variant=both,
+          platforms=both, no tag_override). For non-patch bumps build the
+          chart manually.
+        type: boolean
+        default: false
 
 env:
   REPO: a0533057932/redis-docs
@@ -794,3 +803,134 @@ jobs:
               echo '```'
             fi
           } >> "$GITHUB_STEP_SUMMARY"
+
+  # =========================================================================
+  # Phase 5: publish_chart — opt-in. Auto-bump Helm chart patch + appVersion,
+  # commit to this branch, package and push the chart as an OCI artifact.
+  # Only on full builds. For non-patch bumps, build the chart manually.
+  # =========================================================================
+  publish_chart:
+    name: 5. Publish Helm chart (opt-in)
+    needs: [setup, docker]
+    if: >-
+      inputs.publish_chart == true &&
+      inputs.variant == 'both' &&
+      inputs.platforms == 'both' &&
+      inputs.tag_override == ''
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
+          # default GITHUB_TOKEN has write perms on this repo; no PAT needed
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Bump chart files
+        id: bump
+        env:
+          NEW_HASH: ${{ needs.setup.outputs.hash }}
+        run: |
+          set -euo pipefail
+          CHART=helm/redis-docs/Chart.yaml
+
+          OLD_VERSION=$(grep '^version:' "$CHART" | awk '{print $2}')
+          OLD_HASH=$(grep '^appVersion:' "$CHART" | sed -E 's/.*"([^"]+)".*/\1/')
+
+          if [ "$OLD_HASH" = "$NEW_HASH" ]; then
+            echo "appVersion already $NEW_HASH — nothing to bump" >&2
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Auto-bump patch (X.Y.Z -> X.Y.(Z+1))
+          IFS=. read -r MAJ MIN PATCH <<<"$OLD_VERSION"
+          NEW_VERSION="$MAJ.$MIN.$((PATCH + 1))"
+
+          # Replace HASH everywhere (covers Chart.yaml appVersion + tag refs)
+          sed -i "s|${OLD_HASH}|${NEW_HASH}|g" \
+            helm/redis-docs/Chart.yaml \
+            helm/redis-docs/examples/values-openshift-airgapped.yaml \
+            helm/redis-docs/README.md \
+            helm/redis-docs/README-he.md
+
+          # Bump chart version
+          sed -i "s/^version: .*/version: ${NEW_VERSION}/" "$CHART"
+
+          {
+            echo "old_version=$OLD_VERSION"
+            echo "new_version=$NEW_VERSION"
+            echo "old_hash=$OLD_HASH"
+            echo "new_hash=$NEW_HASH"
+            echo "changed=true"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Commit & push
+        if: steps.bump.outputs.changed == 'true'
+        env:
+          NEW_VERSION: ${{ steps.bump.outputs.new_version }}
+          NEW_HASH: ${{ steps.bump.outputs.new_hash }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add helm/
+          git commit -m "chore(helm): bump chart ${NEW_VERSION}, appVersion ${NEW_HASH}"
+          git push
+
+      - name: Install Helm
+        if: steps.bump.outputs.changed == 'true'
+        uses: azure/setup-helm@v4
+
+      - name: Helm registry login
+        if: steps.bump.outputs.changed == 'true'
+        env:
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
+        run: |
+          echo "$DOCKERHUB_TOKEN" | helm registry login \
+            -u "$DOCKERHUB_USERNAME" --password-stdin registry-1.docker.io
+
+      - name: Package & push chart
+        if: steps.bump.outputs.changed == 'true'
+        id: chart_push
+        env:
+          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
+          NEW_VERSION: ${{ steps.bump.outputs.new_version }}
+        run: |
+          set -euo pipefail
+          helm package helm/redis-docs/ -d /tmp/
+          helm push "/tmp/redis-docs-${NEW_VERSION}.tgz" \
+            "oci://registry-1.docker.io/${DOCKERHUB_USERNAME}"
+
+      - name: Write chart summary
+        if: always()
+        env:
+          STATUS: ${{ job.status }}
+          CHANGED: ${{ steps.bump.outputs.changed }}
+          OLD_VERSION: ${{ steps.bump.outputs.old_version }}
+          NEW_VERSION: ${{ steps.bump.outputs.new_version }}
+          NEW_HASH: ${{ steps.bump.outputs.new_hash }}
+          DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
+        run: |
+          {
+            echo ""
+            echo "## Helm chart publish: \`$STATUS\`"
+            echo ""
+            if [ "$CHANGED" != "true" ]; then
+              echo "Chart appVersion was already up to date — nothing pushed."
+            else
+              echo "| Field | Value |"
+              echo "|-------|-------|"
+              echo "| version | \`$OLD_VERSION\` -> \`$NEW_VERSION\` |"
+              echo "| appVersion | \`$NEW_HASH\` |"
+              echo "| OCI ref | \`oci://registry-1.docker.io/$DOCKERHUB_USERNAME/redis-docs:$NEW_VERSION\` |"
+              echo ""
+              echo "### Install"
+              echo '```bash'
+              echo "helm install <release> oci://registry-1.docker.io/$DOCKERHUB_USERNAME/redis-docs \\"
+              echo "  --version $NEW_VERSION --set route.enabled=true"
+              echo '```'
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"