From 68a2d8ec9f3988094e2f63521f119e3f70ed0b56 Mon Sep 17 00:00:00 2001 From: David Papp Date: Fri, 18 Sep 2026 16:35:33 +0200 Subject: [PATCH] fix(ci): stop the release from publishing charts with no subcharts Tagging main as it stands would have published synapse with an EMPTY charts/ directory. Verified by packaging at the merge commit: the artifact contains zero subcharts, and installing it with `cert-manager.enabled: true` renders nothing at all. A gated subchart that is simply absent is indistinguishable from one that is turned off, so nothing anywhere reports a problem. Two independent failures, both swallowed by the same `|| true`: 1. charts/synapse/Chart.lock was stale. It was generated before the cert-manager condition was renamed to `cert-manager.enabled`, and the lock digest covers the dependency entries, so `helm dependency build` refused it on any clean checkout. Regenerated here. 2. The release job only ran `helm repo add valkey` - a repository nothing has depended on since Dragonfly replaced it - and never added jetstack. Without it cert-manager cannot be resolved at all, even from a correct lock. The release job now adds jetstack and builds strictly, so either failure stops the release instead of quietly shrinking the artifact. PR CI gets the same treatment, and for the same reason it stayed green through both: its `helm dependency build || helm dependency update` fallback rewrote the stale lock in place, so every check ran against a repaired tree rather than the one being merged. synapse 0.10.1 -> 0.10.2, synapse-stack 0.12.1 -> 0.12.2 with both pins. --- .github/workflows/release-charts.yaml | 16 +++++++++++++--- .github/workflows/validate-charts.yaml | 14 +++++++++----- charts/synapse-stack/Chart.lock | 8 ++++---- charts/synapse-stack/Chart.yaml | 8 ++++---- charts/synapse/Chart.lock | 4 ++-- charts/synapse/Chart.yaml | 6 ++++-- 6 files changed, 36 insertions(+), 20 deletions(-) diff --git a/.github/workflows/release-charts.yaml b/.github/workflows/release-charts.yaml index 0d30254..9e21799 100644 --- a/.github/workflows/release-charts.yaml +++ b/.github/workflows/release-charts.yaml @@ -53,13 +53,23 @@ jobs: - name: Add repositories for dependencies run: | - helm repo add valkey https://valkey.io/valkey-helm/ + # Every non-OCI dependency repository must be here. dragonfly is OCI + # and needs no `repo add`; cert-manager is not, and without jetstack + # `helm dependency build` cannot resolve it at all. + helm repo add jetstack https://charts.jetstack.io helm repo update - name: Build chart dependencies run: | - for chart in charts/*; do - [ -f "$chart/Chart.yaml" ] && helm dependency build "$chart" || true + # No `|| true`. Swallowing this is how a release ships a chart with + # an EMPTY charts/ directory: dependency build fails, chart-releaser + # packages whatever is on disk, and the published chart renders none + # of its subcharts - silently, because a gated subchart that is + # simply absent looks exactly like one that is turned off. + set -euo pipefail + for chart in charts/*/; do + [ -f "$chart/Chart.yaml" ] || continue + helm dependency build "$chart" done - name: Run chart-releaser diff --git a/.github/workflows/validate-charts.yaml b/.github/workflows/validate-charts.yaml index 1af6478..e24ed5a 100644 --- a/.github/workflows/validate-charts.yaml +++ b/.github/workflows/validate-charts.yaml @@ -30,17 +30,21 @@ jobs: - name: Add repositories for dependencies run: | - helm repo add valkey https://valkey.io/valkey-helm/ + # Keep in step with release-charts.yaml. dragonfly is OCI and needs + # no `repo add`; cert-manager needs jetstack. + helm repo add jetstack https://charts.jetstack.io helm repo update - # Only synapse-stack has a tracked Chart.lock. `build` happens to fall - # back to resolving when the lock is absent, but that is version- - # dependent behaviour, so fall back explicitly rather than rely on it. + # Strictly `build`, with no `update` fallback. The fallback used to + # regenerate a stale Chart.lock in place, so CI passed on a lock that a + # clean checkout - and the release job - could not build from. Reviewing + # a repaired tree tells you nothing about the tree you are shipping. - name: Build chart dependencies run: | + set -euo pipefail for chart in charts/*/; do [ -f "$chart/Chart.yaml" ] || continue - helm dependency build "$chart" || helm dependency update "$chart" + helm dependency build "$chart" done - name: helm lint diff --git a/charts/synapse-stack/Chart.lock b/charts/synapse-stack/Chart.lock index 8398911..d52e8ae 100644 --- a/charts/synapse-stack/Chart.lock +++ b/charts/synapse-stack/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: synapse repository: file://../synapse - version: 0.10.1 + version: 0.10.2 - name: synapse repository: file://../synapse - version: 0.10.1 -digest: sha256:ac214a2d21ccf8348b81aeee7abea4e3261c689c54930394b8ea186ef32169fc -generated: "2026-09-18T15:24:14.08431236+02:00" + version: 0.10.2 +digest: sha256:b70e93b023771c29502c9075033c13e50231bd06568cd62eb574a1da789efe74 +generated: "2026-09-18T16:34:46.22438654+02:00" diff --git a/charts/synapse-stack/Chart.yaml b/charts/synapse-stack/Chart.yaml index 74ff966..41c4007 100644 --- a/charts/synapse-stack/Chart.yaml +++ b/charts/synapse-stack/Chart.yaml @@ -3,8 +3,8 @@ name: synapse-stack description: Umbrella chart that installs the Synapse dataplane together with the Synapse operator # Release synapse-stack v0.1.5 type: application -# Bumped: refuse cert-manager on both aliases, and follow synapse to 0.10.1. -version: 0.12.1 +# Bumped: follows synapse to 0.10.2 (regenerated Chart.lock). +version: 0.12.2 appVersion: "0.8.3" home: https://gen0sec.com icon: https://raw.githubusercontent.com/gen0sec/helm-charts/main/images/logo.png @@ -24,12 +24,12 @@ dependencies: # proxy → synapse-proxy (TLS passthrough / L7 / Tier-2 terminate) # agent → synapse-agent (XDP transparent observe; edge only) - name: synapse - version: 0.10.1 + version: 0.10.2 repository: "file://../synapse" alias: proxy condition: proxy.enabled - name: synapse - version: 0.10.1 + version: 0.10.2 repository: "file://../synapse" alias: agent condition: agent.enabled diff --git a/charts/synapse/Chart.lock b/charts/synapse/Chart.lock index 1ba2618..b4d68ec 100644 --- a/charts/synapse/Chart.lock +++ b/charts/synapse/Chart.lock @@ -5,5 +5,5 @@ dependencies: - name: cert-manager repository: https://charts.jetstack.io version: v1.21.2 -digest: sha256:c69675ad6ece0f9f158e06dfb961dddbd9978d53fdecbea3707cd9826b9a7d67 -generated: "2026-09-18T14:32:21.205837929+02:00" +digest: sha256:ead8c693a6d8ab0916de913cc29342857ed6bc57e4635b1f157090c19ecd23b3 +generated: "2026-09-18T16:32:31.428981784+02:00" diff --git a/charts/synapse/Chart.yaml b/charts/synapse/Chart.yaml index e93b928..ec464a4 100644 --- a/charts/synapse/Chart.yaml +++ b/charts/synapse/Chart.yaml @@ -3,8 +3,10 @@ name: synapse description: A Helm chart for Synapse reverse proxy with security features type: application -# Bumped: refuse cert-manager and synapse's built-in ACME at the same time. -version: 0.10.1 +# Bumped: Chart.lock regenerated. The committed lock predated the +# cert-manager condition rename, so `helm dependency build` failed on a clean +# checkout and the release packaged this chart with no subcharts at all. +version: 0.10.2 appVersion: "0.8.3" dependencies: