Publish 0.0.0-development Helm chart on main merges

[bramwelt]

Summary

• Adds release-helm-chart job to ko-build-main.yaml that publishes a 0.0.0-development Helm chart to GHCR on every push to main
• Mirrors the tagged release workflow's chart publishing step, without cosign signing or SLSA provenance (not needed for dev builds)
• Adds top-level HELM_VERSION: v3.18.4 env var and packages: write permission to match the tag workflow

Test plan

• Merge to main and confirm chart is published to ghcr.io/linuxfoundation/lfx-v2-query-service/chart/lfx-v2-query-service:0.0.0-development
• Verify release-helm-chart job runs after publish job succeeds

Issue: LFXV2-2482

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ebabc393-69e4-46be-96bb-772a9a983c34

📥 Commits

Reviewing files that changed from the base of the PR and between 011b7a3 and 1e17a12.

📒 Files selected for processing (1)

• .github/workflows/ko-build-main.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/ko-build-main.yaml

---

Walkthrough

The main build workflow gains a workflow-level HELM_VERSION env variable and a new release-helm-chart job that runs after publish, checks out the repo, and pushes the lfx-v2-query-service Helm chart to ghcr.io via helm-chart-oci-publisher with fixed development versioning.

Changes

Helm Chart Release Job

Layer / File(s)	Summary
Workflow-level env configuration .github/workflows/ko-build-main.yaml	Adds HELM_VERSION to workflow-level env block.
release-helm-chart job .github/workflows/ko-build-main.yaml	Adds a new job depending on publish, running on ubuntu-24.04; checks out the repository and invokes a pinned helm-chart-oci-publisher action to publish the chart to ghcr.io with chart_version: 0.0.0-development and app_version: development, authenticated via GITHUB_TOKEN.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding a workflow job to publish a development version of a Helm chart automatically on main branch merges.
Description check	✅ Passed	The description is directly related to the changeset, detailing the new job, workflow modifications, and test plan for publishing the Helm chart on main merges.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch tbramwell/LFXV2-2482-dev-helm-chart

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the main-branch build workflow to also publish an OCI Helm chart tagged as 0.0.0-development to GHCR on every push to main, aligning the “dev” publishing path with the tagged release workflow’s chart publishing behavior (minus signing/provenance).

Changes:

• Adds a release-helm-chart job to publish a development Helm chart to GHCR after the image publish job succeeds.
• Adds a workflow-level HELM_VERSION environment variable for consistent Helm tooling.
• Updates workflow token permissions to support publishing to GHCR.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ko-build-main.yaml:
- Around line 15-17: Remove the unnecessary `packages: write` permission from
the workflow-level permissions block since both the `publish` and
`release-helm-chart` jobs already declare this permission at job scope,
following the principle of least privilege. Additionally, locate the checkout
action in the workflow and add the `persist-credentials: false` configuration to
disable credential persistence, as this workflow does not require authenticated
Git operations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2aebba1f-a469-48e8-a039-219ff99877f5

📥 Commits

Reviewing files that changed from the base of the PR and between 0b6ee6b and 011b7a3.

📒 Files selected for processing (1)

• .github/workflows/ko-build-main.yaml

[bramwelt]

Review feedback addressed (1e17a12)

Fixed:

• Removed packages: write from the top-level permissions block — both jobs already declare it at job scope, so the workflow-level grant was redundant
• Added persist-credentials: false to the release-helm-chart checkout step for security hardening

Not changed:

• The # main comment on SHA-pinned uses: lines — this is an intentional repo convention documenting which branch the SHA was sourced from. The tag workflow uses the same pattern throughout.

[bramwelt]

Review Feedback Addressed

Commit: 1e17a12

Changes Made

• .github/workflows/ko-build-main.yaml: Removed packages: write from top-level permissions block — both jobs already declare it at job scope (per copilot-pull-request-reviewer, coderabbitai[bot])
• .github/workflows/ko-build-main.yaml: Added persist-credentials: false to release-helm-chart checkout step (per coderabbitai[bot])

No Change Needed

• .github/workflows/ko-build-main.yaml:63: The # main trailing comment on SHA-pinned uses: is intentional repo convention — it documents which branch the SHA was sourced from, not a moving ref. The tag workflow uses the same pattern throughout. (flagged by copilot-pull-request-reviewer)

Threads Resolved

3 of 3 unresolved threads addressed.