ci: publish Helm charts in a dedicated job gated on image builds

.github/workflows/publish_image_chart.yaml

@@ -97,6 +97,22 @@ jobs:
           cache-from: type=registry,ref=${{ matrix.container_registry }}/${{ matrix.image }}:latest
           cache-to: type=inline
 
+  # Publish Helm charts once, only after every image in the artifacts matrix has
+  # been pushed. This keeps charts from being published before their images exist,
+  # avoids concurrent duplicate pushes, and blocks the publish if a build fails.
+  charts:
+    runs-on: ubuntu-24.04
+    needs: artifacts
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Determine version
+        run: echo "PIPECD_VERSION=$(git describe --tags --always --abbrev=7 --match 'v[0-9]*.*')" >> $GITHUB_ENV
+
       # Building and pushing Helm charts.
       - name: Install helm
         uses: azure/setup-helm@v4
@@ -114,7 +130,7 @@ jobs:
 
   trigger-event-watcher:
     runs-on: ubuntu-24.04
-    needs: artifacts
+    needs: charts
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -136,7 +152,7 @@ jobs:
 
   release-quickstart-manifests:
     runs-on: ubuntu-24.04
-    needs: artifacts
+    needs: charts
     # ignore release candidates
     if: startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-rc')
     permissions: