Skip to content

feat: publish Helm chart as an OCI artifact to ghcr.io #845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jabenedicic wants to merge 1 commit into
base: main
Choose a base branch
from
+64 −0
Open

feat: publish Helm chart as an OCI artifact to ghcr.io #845

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,3 +182,49 @@ jobs:
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
branch: ${{ env.GITHUB_PAGES_BRANCH }}

release-charts-oci:
needs: release-please
permissions:
contents: read
packages: write # to push the Helm chart as an OCI artifact
runs-on: ubuntu-24.04
if: ${{ needs.release-please.outputs.release_created }}
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
ref: ${{ needs.release-please.outputs.release_tag_name }}

- name: Setup go
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
with:
go-version: ${{ env.DEFAULT_GO_VERSION }}

- name: Log in to the Container registry
uses: docker/login-action@327cd5a69de6c009b9ce71bce8395f28e651bf99
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Package and push the Helm chart as an OCI artifact
run: |
make workspace-init
go mod tidy
make controller-gen
IMG=ghcr.io/open-feature/open-feature-operator:${{ needs.release-please.outputs.release_tag_name }} make helm-package
make helm-push-oci CHART_OCI_REGISTRY=oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts

- name: Install cosign
uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4
with:
cosign-release: 'v2.6.0'

- name: Sign the published Helm chart
run: |
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/open-feature-operator:${{ needs.release-please.outputs.release_tag_name }}
env:
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
if: ${{ env.DRY_RUN != 'true' }}
6 changes: 6 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ IMG?=$(RELEASE_REGISTRY)/$(RELEASE_IMAGE)
# customize overlay to be used in the build, DEFAULT or HELM
KUSTOMIZE_OVERLAY ?= DEFAULT
CHART_VERSION=v0.9.2# x-release-please-version
# OCI registry the packaged Helm chart is pushed to (helm appends the chart name).
CHART_OCI_REGISTRY?=oci://ghcr.io/open-feature/charts

@gemini-code-assist gemini-code-assist Bot May 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

There is an inconsistency in the default organization/registry namespace used in the Makefile:

  • RELEASE_REGISTRY (line 1) defaults to ghcr.io/openfeature (no hyphen).
  • CHART_OCI_REGISTRY (line 11) defaults to oci://ghcr.io/open-feature/charts (with hyphen).

Since the official GitHub organization is open-feature (with a hyphen), RELEASE_REGISTRY might contain a typo or legacy value. Consider aligning them to use the correct open-feature namespace across both variables to avoid confusion or publishing to the wrong registry namespace.

# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
ENVTEST_K8S_VERSION = 1.26.1
WAIT_TIMEOUT_SECONDS?=60
Expand Down Expand Up @@ -257,6 +259,10 @@ helm-package: set-helm-overlay generate release-manifests helm
$(HELM) repo index --url https://open-feature.github.io/open-feature-operator/charts charts
mv charts/index.yaml index.yaml

.PHONY: helm-push-oci
helm-push-oci: helm ## Push the packaged Helm chart to an OCI registry (run helm-package first; requires a prior helm/docker registry login).
$(HELM) push charts/open-feature-operator-$(CHART_VERSION).tgz $(CHART_OCI_REGISTRY)

install-mockgen:
go install github.com/golang/mock/mockgen@v1.6.0
mockgen: install-mockgen
Expand Down
12 changes: 12 additions & 0 deletions docs/installation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,18 @@ helm repo update &&
helm upgrade --install openfeature openfeature/open-feature-operator
```

### OCI registry

The chart is also published as an OCI artifact to GitHub Container Registry, signed with [cosign](https://github.com/sigstore/cosign). This is convenient if you want to mirror or proxy it through your own registry (e.g. JFrog Artifactory, Harbor).

<!-- x-release-please-start-version -->
```sh
helm upgrade --install openfeature \
oci://ghcr.io/open-feature/charts/open-feature-operator \
--version v0.9.2
```
<!-- x-release-please-end -->

### Upgrading

```sh
Expand Down
Loading