From f2120fe5d6d4af5783d9e2702d01aa770b48ecbb Mon Sep 17 00:00:00 2001
From: TheRealShek <shadow.abhi100@gmail.com>
Date: Mon, 20 Jul 2026 16:52:50 +0530
Subject: [PATCH] ci: publish Helm charts in a dedicated job gated on image
 builds

Move the Helm chart publish out of the artifacts matrix into a separate
`charts` job with `needs: artifacts`, mirroring publish_pipedv1_exp.yaml.
Charts now publish exactly once, only after every image has been pushed,
and a failed image build blocks the publish. Repoint the downstream
trigger-event-watcher and release-quickstart-manifests jobs to needs: charts.

Fixes #6999

Signed-off-by: TheRealShek <shadow.abhi100@gmail.com>
---
 .github/workflows/publish_image_chart.yaml | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish_image_chart.yaml b/.github/workflows/publish_image_chart.yaml
index 8872ee6e5c..8ed8b6a98e 100644
--- a/.github/workflows/publish_image_chart.yaml
+++ b/.github/workflows/publish_image_chart.yaml
@@ -97,6 +97,22 @@ jobs:
           cache-from: type=registry,ref=${{ matrix.container_registry }}/${{ matrix.image }}:latest
           cache-to: type=inline
 
+  # Publish Helm charts once, only after every image in the artifacts matrix has
+  # been pushed. This keeps charts from being published before their images exist,
+  # avoids concurrent duplicate pushes, and blocks the publish if a build fails.
+  charts:
+    runs-on: ubuntu-24.04
+    needs: artifacts
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Determine version
+        run: echo "PIPECD_VERSION=$(git describe --tags --always --abbrev=7 --match 'v[0-9]*.*')" >> $GITHUB_ENV
+
       # Building and pushing Helm charts.
       - name: Install helm
         uses: azure/setup-helm@v4
@@ -114,7 +130,7 @@ jobs:
 
   trigger-event-watcher:
     runs-on: ubuntu-24.04
-    needs: artifacts
+    needs: charts
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -136,7 +152,7 @@ jobs:
 
   release-quickstart-manifests:
     runs-on: ubuntu-24.04
-    needs: artifacts
+    needs: charts
     # ignore release candidates
     if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-rc')
     permissions: