ci(helm): publish charts to GHCR instead of creating releases

.github/workflows/helm-charts.yml

@@ -0,0 +1,109 @@
+name: Helm charts
+
+on:
+  pull_request:
+    paths:
+      - "supplemental/helm/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "supplemental/helm/**"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  OCI_REGISTRY: ghcr.io/henrygd/beszel-charts
+
+jobs:
+  changes:
+    name: Detect changed charts
+    runs-on: ubuntu-latest
+    outputs:
+      charts: ${{ steps.changes.outputs.charts }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed charts
+        id: changes
+        env:
+          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          charts=()
+
+          for name in beszel-agent beszel-hub; do
+            path="supplemental/helm/$name"
+            if ! git diff --quiet "$BASE_SHA" "$GITHUB_SHA" -- "$path"; then
+              charts+=("$name|$path")
+            fi
+          done
+
+          printf '%s\n' "${charts[@]}" \
+            | jq -Rsc 'split("\n") | map(select(length > 0) | split("|") | {name: .[0], path: .[1]})' \
+            | xargs -0 printf 'charts=%s\n' >> "$GITHUB_OUTPUT"
+
+  validate-and-publish:
+    name: ${{ github.event_name == 'push' && 'Publish' || 'Validate' }} ${{ matrix.chart.name }}
+    needs: changes
+    if: needs.changes.outputs.charts != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        chart: ${{ fromJSON(needs.changes.outputs.charts) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Lint chart
+        run: helm lint "${{ matrix.chart.path }}" --set env.KEY=ci-placeholder
+
+      - name: Render chart
+        run: helm template "${{ matrix.chart.name }}" "${{ matrix.chart.path }}" --set env.KEY=ci-placeholder > /dev/null
+
+      - name: Package chart
+        id: package
+        env:
+          CHART_NAME: ${{ matrix.chart.name }}
+          CHART_PATH: ${{ matrix.chart.path }}
+        run: |
+          version=$(awk '/^version:/ { print $2 }' "$CHART_PATH/Chart.yaml")
+          test -n "$version"
+
+          mkdir -p .helm-packages
+          helm package "$CHART_PATH" --destination .helm-packages
+
+          package=".helm-packages/${CHART_NAME}-${version}.tgz"
+          test -f "$package"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "package=$package" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: echo "$GITHUB_TOKEN" | helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+
+      - name: Check chart version is unpublished
+        env:
+          CHART_NAME: ${{ matrix.chart.name }}
+          CHART_VERSION: ${{ steps.package.outputs.version }}
+        run: |
+          chart="oci://${OCI_REGISTRY}/${CHART_NAME}"
+          if helm show chart "$chart" --version "$CHART_VERSION" > /dev/null 2>&1; then
+            echo "${CHART_NAME} ${CHART_VERSION} is already published. Bump version in Chart.yaml." >&2
+            exit 1
+          fi
+
+      - name: Publish chart
+        if: github.event_name == 'push'
+        run: helm push "${{ steps.package.outputs.package }}" "oci://${OCI_REGISTRY}"

.github/workflows/release-please.yml

@@ -1,152 +0,0 @@
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/release-please.yml"
-      - "release-please-config.json"
-      - ".release-please-manifest.json"
-      - "supplemental/helm/**"
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-env:
-  PUBLISHABLE_ITEMS: '["supplemental/helm/beszel-agent", "supplemental/helm/beszel-hub"]'
-
-name: helm-release
-
-concurrency:
-  group: helm-release
-  cancel-in-progress: false
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - uses: googleapis/release-please-action@v4
-        name: Prepare release
-        id: release-please
-        with:
-          token: ${{ secrets.CR_TOKEN }}
-
-      - name: Dump Release Please Output
-        env:
-          RELEASE_PLEASE_OUTPUT: ${{ toJson(steps.release-please.outputs) }}
-        run: |
-          echo "$RELEASE_PLEASE_OUTPUT"
-
-      - name: Determine what should be published
-        uses: actions/github-script@v8
-        id: items-to-publish
-        env:
-          CHANGED_ITEMS: "${{ steps.release-please.outputs.paths_released }}"
-        with:
-          script: |
-            const changedItems = JSON.parse(process.env.CHANGED_ITEMS || '[]');
-            console.log("changed items", changedItems);
-            const eligibleItems = JSON.parse(process.env.PUBLISHABLE_ITEMS || '[]');
-            console.log("eligible items", eligibleItems);
-            const itemsToPublish = changedItems.filter(i => eligibleItems.includes(i));
-            console.log("items to publish", itemsToPublish);
-            return itemsToPublish;
-    outputs:
-      items_to_publish: ${{ steps.items-to-publish.outputs.result }}
-      releases: ${{ toJson(steps.release-please.outputs) }}
-
-  release-charts:
-    name: Release Charts
-    needs: release
-    runs-on: ubuntu-latest
-    if: ${{ needs.release.outputs.items_to_publish != '' && toJson(fromJson(needs.release.outputs.items_to_publish)) != '[]' }}
-    strategy:
-      fail-fast: false
-      max-parallel: 1
-      matrix:
-        path: ${{ fromJSON(needs.release.outputs.items_to_publish) }}
-
-    env:
-      TAG: ${{ fromJson(needs.release.outputs.releases)[format('{0}--tag_name', matrix.path)] }}
-      VERSION: ${{ fromJson(needs.release.outputs.releases)[format('{0}--version', matrix.path)] }}
-      RELEASE_ID: ${{ fromJson(needs.release.outputs.releases)[format('{0}--id', matrix.path)] }}
-
-    steps:
-      - name: Debug
-        run: |
-          echo ${{ env.TAG }}
-          echo ${{ env.VERSION }}
-          echo ${{ matrix.path }}
-
-      - name: ✨ Checkout repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          echo ${{ needs.release.outputs.items_to_publish }}
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
-
-      - name: Install Chart Releaser
-        run: |
-          version=v1.6.0
-          mkdir .tmp
-          install_dir=.tmp
-          echo "Installing chart-releaser on $install_dir..."
-          curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/$version/chart-releaser_${version#v}_linux_amd64.tar.gz"
-          tar -xzf cr.tar.gz -C "$install_dir"
-          rm -f cr.tar.gz
-
-      - name: Package chart
-        run: |
-          .tmp/cr package ${{ matrix.path }}
-          ls -la .cr-release-packages/
-
-      - name: Upload chart package to draft release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload "$TAG" .cr-release-packages/*.tgz --clobber
-
-      - name: Publish chart release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHART_PATH: ${{ matrix.path }}
-        run: |
-          chart_name="${CHART_PATH##*/}"
-          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
-            -f "name=Helm chart: ${chart_name} v${VERSION}" \
-            -F draft=false \
-            -f make_latest=false
-
-      - name: Update index
-        run: |
-          owner=$(cut -d '/' -f 1 <<< "$GITHUB_REPOSITORY")
-          repo=$(cut -d '/' -f 2 <<< "$GITHUB_REPOSITORY")
-
-          # Create the local output directory for the generated index
-          mkdir -p docs
-
-          # Generate index.yaml for GitHub Pages
-          args=(-o "$owner" -r "$repo" --push -t "${{ secrets.CR_TOKEN }}" --index-path docs/index.yaml --release-name-template '{{ .Name }}-v{{ .Version }}')
-          .tmp/cr index "${args[@]}"
-
-      - name: Restore application release as latest
-        if: ${{ always() }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          release_id=$(gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" \
-            --jq 'map(select(.draft == false and .prerelease == false and (.tag_name | test("^v[0-9]"))))[0].id')
-          test -n "$release_id"
-          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${release_id}" \
-            -f make_latest=true

.github/workflows/release.yml

@@ -52,51 +52,3 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.TOKEN || secrets.GITHUB_TOKEN }}
           WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
           IS_FORK: ${{ github.repository_owner != 'henrygd' }}
-
-  update-helm-app-version:
-    name: Update Helm app version
-    needs: goreleaser
-    if: ${{ github.repository_owner == 'henrygd' }}
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout main
-        uses: actions/checkout@v7
-        with:
-          ref: main
-          token: ${{ secrets.CR_TOKEN }}
-
-      - name: Update chart app versions
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
-        run: |
-          version="${RELEASE_TAG#v}"
-          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]]; then
-            echo "Invalid release version: $version" >&2
-            exit 1
-          fi
-
-          for chart in supplemental/helm/beszel-agent supplemental/helm/beszel-hub; do
-            current_version=$(awk -F '"' '/^appVersion:/ { print $2 }' "$chart/Chart.yaml")
-            NEW_VERSION="$version" perl -pi -e 's/^appVersion:.*$/appVersion: "$ENV{NEW_VERSION}"/' "$chart/Chart.yaml"
-            OLD_VERSION="$current_version" NEW_VERSION="$version" \
-              perl -pi -e 's/\Q$ENV{OLD_VERSION}\E/$ENV{NEW_VERSION}/g' "$chart/README.md"
-          done
-
-      - name: Commit app version update
-        env:
-          RELEASE_TAG: ${{ github.ref_name }}
-        run: |
-          if git diff --quiet -- supplemental/helm; then
-            echo "Helm charts already use ${RELEASE_TAG#v}"
-            exit 0
-          fi
-
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add supplemental/helm/beszel-agent/Chart.yaml \
-            supplemental/helm/beszel-agent/README.md \
-            supplemental/helm/beszel-hub/Chart.yaml \
-            supplemental/helm/beszel-hub/README.md
-          git commit -m "fix(helm): update app version to ${RELEASE_TAG#v}"
-          git push origin HEAD:main

.release-please-manifest.json

@@ -1,4 +0,0 @@
-{
-  "supplemental/helm/beszel-agent": "0.1.4",
-  "supplemental/helm/beszel-hub": "0.1.4"
-}

docs/index.yaml

@@ -1,3 +0,0 @@
-apiVersion: v1
-entries: {}
-generated: "2026-03-05T00:00:00Z"

release-please-config.json

@@ -1,26 +0,0 @@
-{
-  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
-  "release-type": "simple",
-  "packages": {
-    "supplemental/helm/beszel-agent": {
-      "package-name": "beszel-agent",
-      "release-type": "helm",
-      "changelog-path": "CHANGELOG.md",
-      "bump-minor-pre-major": true,
-      "bump-patch-for-minor-pre-major": true,
-      "draft": true,
-      "force-tag-creation": true,
-      "prerelease": false
-    },
-    "supplemental/helm/beszel-hub": {
-      "package-name": "beszel-hub",
-      "release-type": "helm",
-      "changelog-path": "CHANGELOG.md",
-      "bump-minor-pre-major": true,
-      "bump-patch-for-minor-pre-major": true,
-      "draft": true,
-      "force-tag-creation": true,
-      "prerelease": false
-    }
-  }
-}

supplemental/helm/beszel-agent/Chart.yaml

@@ -3,7 +3,7 @@ description: Installs beszel-agent in kubernetes
 home: https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-agent
 name: beszel-agent
 appVersion: "0.18.7"
-# The release workflow manages this chart version; do not edit manually.
+# Bump this version when publishing chart changes.
 version: 0.1.4
 sources:
   - https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-agent

supplemental/helm/beszel-agent/README.md

@@ -41,17 +41,10 @@ In Kubernetes environments, the Beszel agent monitors **node-level metrics**:
 
 ## Quick Start
 
-### 1. Add the Helm Repository
+### 1. Install the OCI Chart
 
 ```bash
-helm repo add beszel https://henrygd.github.io/beszel
+helm install beszel-agent oci://ghcr.io/henrygd/beszel-charts/beszel-agent \
-helm repo update
-```
-
-### 2. Install the Chart
-
-```bash
-helm install beszel-agent ./beszel-agent \
   --set env.KEY="ssh-ed25519 AAAA... your-public-key" \
   --set env.TOKEN="your-token-value" \
   --set env.HUB_URL="http://beszel-hub:8090"
@@ -60,10 +53,10 @@ helm install beszel-agent ./beszel-agent \
 Or with custom values:
 
 ```bash
-helm install beszel-agent ./beszel-agent -f custom-values.yaml
+helm install beszel-agent oci://ghcr.io/henrygd/beszel-charts/beszel-agent -f custom-values.yaml
 ```
 
-### 3. Verify the Agent is Running
+### 2. Verify the Agent is Running
 
 ```bash
 kubectl get pods -l app.kubernetes.io/name=beszel-agent

supplemental/helm/beszel-agent/values.yaml

@@ -2,10 +2,6 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
-# To add the Helm repository:
-# helm repo add beszel https://henrygd.github.io/beszel
-# helm repo update
-
 # This will set the replicaset count more information can be found here: https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/
 replicaCount: 1
 

supplemental/helm/beszel-hub/Chart.yaml

@@ -3,7 +3,7 @@ description: Installs beszel-hub in kubernetes
 home: https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-hub
 name: beszel-hub
 appVersion: "0.18.7"
-# The release workflow manages this chart version; do not edit manually.
+# Bump this version when publishing chart changes.
 version: 0.1.4
 sources:
   - https://github.com/henrygd/beszel/tree/main/supplemental/helm/beszel-hub

supplemental/helm/beszel-hub/README.md

@@ -14,26 +14,19 @@ This Helm chart simplifies the deployment of Beszel Hub in Kubernetes environmen
 
 ## Quick Start
 
-### 1. Add the Repository
+### 1. Install the OCI Chart
 
 ```bash
-helm repo add beszel https://henrygd.github.io/beszel
+helm install beszel-hub oci://ghcr.io/henrygd/beszel-charts/beszel-hub
-helm repo update
-```
-
-### 2. Install the Chart
-
-```bash
-helm install beszel-hub ./beszel-hub
 ```
 
 Or with a custom values file:
 
 ```bash
-helm install beszel-hub ./beszel-hub -f custom-values.yaml
+helm install beszel-hub oci://ghcr.io/henrygd/beszel-charts/beszel-hub -f custom-values.yaml
 ```
 
-### 3. Access Beszel Hub
+### 2. Access Beszel Hub
 
 By default, Beszel Hub is accessible at `http://beszel-hub:8090` within the cluster.
 

supplemental/helm/beszel-hub/values.yaml

@@ -2,10 +2,6 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
-# To add the Helm repository:
-# helm repo add beszel https://henrygd.github.io/beszel
-# helm repo update
-
 # -- The number of replicas
 replicaCount: 1