From 011b7a32724a4af7944c6b2ee88d303cc2594893 Mon Sep 17 00:00:00 2001 From: Trevor Bramwell Date: Mon, 22 Jun 2026 15:06:02 -0700 Subject: [PATCH 1/2] Publish dev helm chart on main merges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add release-helm-chart job to ko-build-main.yaml that publishes a 0.0.0-development Helm chart to GHCR on every push to main, mirroring the tagged release workflow but without cosign signing or SLSA provenance. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Issue: LFXV2-2482 Co-Authored-By: Claude Sonnet 4.6 Signed-off-by: Trevor Bramwell --- .github/workflows/ko-build-main.yaml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/ko-build-main.yaml b/.github/workflows/ko-build-main.yaml index 44a7ad7..b682285 100644 --- a/.github/workflows/ko-build-main.yaml +++ b/.github/workflows/ko-build-main.yaml @@ -9,8 +9,12 @@ name: Publish Main - main workflow_dispatch: +env: + HELM_VERSION: v3.18.4 + permissions: contents: read + packages: write jobs: publish: @@ -42,3 +46,25 @@ jobs: -t ${{ github.sha }} \ -t development \ --sbom spdx + + release-helm-chart: + needs: publish + runs-on: ubuntu-24.04 + permissions: + contents: read + packages: write + steps: + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + + - name: Publish Chart to GHCR + # yamllint disable-line rule:line-length + uses: linuxfoundation/lfx-public-workflows/.github/actions/helm-chart-oci-publisher@17e4144d7ba68f7c3e8c16eece5aed15fd7c2dc8 # main + with: + name: lfx-v2-query-service + repository: ${{ github.repository }}/chart + chart_version: 0.0.0-development + app_version: development + registry: ghcr.io + registry_username: ${{ github.actor }} + registry_password: ${{ secrets.GITHUB_TOKEN }} From 1e17a1259980f158f40a08fefc10e5377ca7fe61 Mon Sep 17 00:00:00 2001 From: Trevor Bramwell Date: Mon, 22 Jun 2026 15:29:20 -0700 Subject: [PATCH 2/2] Address PR #60 review comments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove top-level `packages: write` permission (each job already declares it at job level) - Add `persist-credentials: false` to release-helm-chart checkout step for security hardening 🤖 Generated with [Claude Code](https://claude.com/claude-code) Issue: LFXV2-2482 Co-Authored-By: Claude Sonnet 4.6 Signed-off-by: Trevor Bramwell --- .github/workflows/ko-build-main.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ko-build-main.yaml b/.github/workflows/ko-build-main.yaml index b682285..839465c 100644 --- a/.github/workflows/ko-build-main.yaml +++ b/.github/workflows/ko-build-main.yaml @@ -14,7 +14,6 @@ env: permissions: contents: read - packages: write jobs: publish: @@ -56,6 +55,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 + with: + persist-credentials: false - name: Publish Chart to GHCR # yamllint disable-line rule:line-length