🏷️ ci: Sync Helm Chart Tags (#13446)

* ci: Sync Helm chart tags

* ci: Address Helm tag sync review

.github/workflows/helmcharts.yml

@@ -5,18 +5,52 @@ on:
   push:
     tags:
       - "chart-*"
+  workflow_dispatch:
+    inputs:
+      chart_tag:
+        description: "Existing chart tag to release, for example chart-2.0.5"
+        required: true
+        type: string
 
 jobs:
   release:
     permissions:
-      contents: write
+      contents: read
       packages: write
     runs-on: ubuntu-latest
+    env:
+      CHART_REPOSITORY: ${{ github.repository_owner }}/librechat-chart
     steps:
+      - name: Resolve chart tag
+        id: chart-version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_CHART_TAG: ${{ inputs.chart_tag || '' }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          CHART_TAG="$REF_NAME"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            CHART_TAG="$INPUT_CHART_TAG"
+          fi
+
+          CHART_VERSION="${CHART_TAG#chart-}"
+          SEMVER_REGEX='^[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z.-]+)?([+][0-9A-Za-z.-]+)?$'
+          if [[ "$CHART_TAG" != chart-* || ! "$CHART_VERSION" =~ $SEMVER_REGEX ]]; then
+            echo "::error::Chart tags must use the form chart-<semver>, for example chart-2.0.3"
+            exit 1
+          fi
+
+          printf 'CHART_REF=refs/tags/%s\n' "$CHART_TAG" >> "$GITHUB_OUTPUT"
+          printf 'CHART_TAG=%s\n' "$CHART_TAG" >> "$GITHUB_OUTPUT"
+          printf 'CHART_VERSION=%s\n' "$CHART_VERSION" >> "$GITHUB_OUTPUT"
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ steps.chart-version.outputs.CHART_REF }}
 
       - name: Configure Git
         run: |
@@ -35,20 +69,6 @@ jobs:
           cd ../librechat-rag-api
           helm dependency build      
 
-      - name: Get Chart Version
-        id: chart-version
-        env:
-          REF_NAME: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          CHART_VERSION="${REF_NAME#chart-}"
-          SEMVER_REGEX='^[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z.-]+)?([+][0-9A-Za-z.-]+)?$'
-          if [[ "$REF_NAME" != chart-* || ! "$CHART_VERSION" =~ $SEMVER_REGEX ]]; then
-            echo "::error::Chart tags must use the form chart-<semver>, for example chart-2.0.3"
-            exit 1
-          fi
-          printf 'CHART_VERSION=%s\n' "$CHART_VERSION" >> "$GITHUB_OUTPUT"
-
       # Log in to GitHub Container Registry
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
@@ -63,7 +83,7 @@ jobs:
         uses: appany/helm-oci-chart-releaser@v0.4.2
         with:
           name: librechat
-          repository: ${{ github.actor }}/librechat-chart
+          repository: ${{ env.CHART_REPOSITORY }}
           tag: ${{ steps.chart-version.outputs.CHART_VERSION }}
           path: helm/librechat
           registry: ghcr.io
@@ -75,7 +95,7 @@ jobs:
         uses: appany/helm-oci-chart-releaser@v0.4.2
         with:
           name: librechat-rag-api
-          repository: ${{ github.actor }}/librechat-chart
+          repository: ${{ env.CHART_REPOSITORY }}
           tag: ${{ steps.chart-version.outputs.CHART_VERSION }}
           path: helm/librechat-rag-api
           registry: ghcr.io

.github/workflows/sync-helm-chart-tags.yml

@@ -0,0 +1,73 @@
+name: Sync Helm Chart Tags
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      release_existing_tag:
+        description: "Existing chart-* tag to dispatch if tag creation succeeded but release dispatch failed"
+        required: false
+        type: string
+
+permissions:
+  actions: write
+  contents: write
+
+concurrency:
+  group: sync-helm-chart-tags
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    name: Sync chart tags
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      BASE_REF: refs/remotes/origin/main
+      BACKFILL_FROM_VERSION: 1.9.0
+      CHART_PATH: helm/librechat/Chart.yaml
+      DEFAULT_BRANCH: main
+      DISPATCH_WORKFLOW: helmcharts.yml
+      GITHUB_SERVER_URL: ${{ github.server_url }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GITHUB_REPOSITORY: ${{ github.repository }}
+      RELEASE_EXISTING_TAG: ${{ inputs.release_existing_tag || '' }}
+      REPO_DIR: ${{ runner.temp }}/librechat
+      TAG_PREFIX: chart-
+    steps:
+      - name: Fetch main and tags
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$GITHUB_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
+            echo "::error::Unexpected repository name: $GITHUB_REPOSITORY"
+            exit 1
+          fi
+
+          if [[ "$GITHUB_SERVER_URL" != "https://github.com" ]]; then
+            echo "::error::Unexpected GitHub server URL: $GITHUB_SERVER_URL"
+            exit 1
+          fi
+
+          rm -rf "$REPO_DIR"
+          git init "$REPO_DIR"
+          cd "$REPO_DIR"
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          git -c "http.${GITHUB_SERVER_URL}/.extraheader=AUTHORIZATION: bearer ${GITHUB_TOKEN}" \
+            fetch --prune --force --tags origin \
+            "+refs/heads/${DEFAULT_BRANCH}:refs/remotes/origin/${DEFAULT_BRANCH}"
+          git checkout --detach "$BASE_REF"
+
+      - name: Create missing chart tags
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PUSH_TAGS: "true"
+        run: |
+          set -euo pipefail
+          cd "$REPO_DIR"
+          .github/scripts/sync-helm-chart-tags.sh