fix(helm): publish immutable chart releases safely, maybe

- Create draft releases before uploading chart packages
- Update the chart index before making releases immutable
- Keep Helm releases out of the latest release channel
- Serialize chart publishing to avoid index races
- Run the workflow only when Helm-related files change

.github/workflows/release-please.yml

@@ -2,6 +2,11 @@ on:
   push:
     branches:
       - main
+    paths:
+      - ".github/workflows/release-please.yml"
+      - "release-please-config.json"
+      - ".release-please-manifest.json"
+      - "supplemental/helm/**"
 
 permissions:
   contents: write
@@ -61,6 +66,7 @@ jobs:
     if: ${{ needs.release.outputs.items_to_publish != '' && toJson(fromJson(needs.release.outputs.items_to_publish)) != '[]' }}
     strategy:
       fail-fast: false
+      max-parallel: 1
       matrix:
         path: ${{ fromJSON(needs.release.outputs.items_to_publish) }}
 
@@ -101,14 +107,10 @@ jobs:
           .tmp/cr package ${{ matrix.path }}
           ls -la .cr-release-packages/
 
-      - name: Upload binaries to release
-        uses: svenstaro/upload-release-action@v2
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: .cr-release-packages/*.tgz
-          file_glob: true
-          overwrite: true
-          tag: ${{ env.TAG }}
+      - name: Upload chart package to draft release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "$TAG" .cr-release-packages/*.tgz --clobber
 
       - name: Update index
         run: |
@@ -122,3 +124,15 @@ jobs:
           # Generate index.yaml for GitHub Pages
           args=(-o "$owner" -r "$repo" -c "https://henrygd.github.io/beszel" --push -t "${{ secrets.CR_TOKEN }}" --index-path docs/index.yaml)
           .tmp/cr index "${args[@]}"
+
+      - name: Publish chart release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CHART_PATH: ${{ matrix.path }}
+        run: |
+          chart_name="${CHART_PATH##*/}"
+          release_id=$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" --jq .id)
+          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${release_id}" \
+            -f "name=Helm chart: ${chart_name} v${VERSION}" \
+            -F draft=false \
+            -f make_latest=false

release-please-config.json

@@ -8,7 +8,8 @@
       "changelog-path": "CHANGELOG.md",
       "bump-minor-pre-major": true,
       "bump-patch-for-minor-pre-major": true,
-      "draft": false,
+      "draft": true,
+      "force-tag-creation": true,
       "prerelease": false
     },
     "supplemental/helm/beszel-hub": {
@@ -17,7 +18,8 @@
       "changelog-path": "CHANGELOG.md",
       "bump-minor-pre-major": true,
       "bump-patch-for-minor-pre-major": true,
-      "draft": false,
+      "draft": true,
+      "force-tag-creation": true,
       "prerelease": false
     }
   }

supplemental/helm/beszel-agent/Chart.yaml

@@ -3,7 +3,7 @@ description: Installs beszel-agent in kubernetes
 home: https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-agent
 name: beszel-agent
 appVersion: "0.17.0"
-# Do not touch will be updated during release
+# This version is managed automatically by Release Please.
 version: 0.1.1
 sources:
   - https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-agent

supplemental/helm/beszel-hub/Chart.yaml

@@ -3,7 +3,7 @@ description: Installs beszel-hub in kubernetes
 home: https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-hub
 name: beszel-hub
 appVersion: "0.17.0"
-# Do not touch will be updated during release
+# This version is managed automatically by Release Please.
 version: 0.1.1
 sources:
   - https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-hub