fix(ci): replace free-text helm version input with dropdown

.github/workflows/helm-release.yml

@@ -4,9 +4,27 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version to publish — must match an existing GitHub release (e.g., 3.8.0 or v3.8.0)'
+        description: 'Select the version to release as a Helm chart (list is kept in sync with GitHub releases)'
         required: true
-        type: string
+        type: choice
+        options:
+          - v4.4.0
+          - v4.4.0-rc.1
+          - v4.3.0
+          - v4.2.0
+          - v4.1.0
+          - v4.0.0
+          - v3.9.0
+          - v3.9.0-rc.4
+          - v3.9.0-rc.3
+          - v3.9.0-rc.2
+          - v3.9.0-rc.1
+          - v3.8.0
+          - v3.8.0-rc.4
+          - v3.8.0-rc.3
+          - v3.8.0-rc.2
+          - v3.8.0-rc.1
+          - v3.6.0
       publish_oci:
         description: 'Push chart package to GHCR (OCI)'
         required: false

.github/workflows/sync-helm-versions.yml

@@ -0,0 +1,67 @@
+name: Sync Helm Version Choices
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update version choices in helm-release.yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python3 - <<'EOF'
+          import subprocess, re, sys
+
+          result = subprocess.run(
+              ['gh', 'release', 'list', '--limit', '20', '--json', 'tagName', '--jq', '.[].tagName'],
+              capture_output=True, text=True
+          )
+          releases = [r.strip() for r in result.stdout.strip().split('\n') if r.strip()]
+
+          if not releases:
+              print("No releases found, nothing to update.")
+              sys.exit(0)
+
+          with open('.github/workflows/helm-release.yml') as f:
+              content = f.read()
+
+          options_block = (
+              "        options:\n"
+              + "\n".join(f"          - {r}" for r in releases)
+              + "\n"
+          )
+
+          new_content = re.sub(
+              r'        options:\n(?:          - .+\n)+',
+              options_block,
+              content
+          )
+
+          if new_content == content:
+              print("No changes needed.")
+              sys.exit(0)
+
+          with open('.github/workflows/helm-release.yml', 'w') as f:
+              f.write(new_content)
+
+          print(f"Updated with {len(releases)} versions: {releases}")
+          EOF
+
+      - name: Commit and push
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .github/workflows/helm-release.yml
+          git diff --staged --quiet && echo "No changes to commit." || \
+            git commit -m "ci: sync helm version choices from releases" && git push