ci: publish Helm chart repository via chart-releaser on release tags

[aslakknutsen]

Summary

Add a publish-helm-chart-repo job to the release workflow that uses helm/chart-releaser-action (with skip_packaging) to publish the Helm chart to a GitHub Pages-hosted repository on each version tag.

• New job packages the chart via make release.manifests, places the tarball in .cr-release-packages/, and delegates upload + index update to chart-releaser.
• Removes dist/*.tgz from the softprops/action-gh-release step so chart-releaser is the sole publisher of the chart asset (avoids duplicate uploads).
• Adds .cr.yaml pointing at gh-pages and documents helm repo add usage in the chart README.

Resolves: #175

Manual steps after merge

One-time (repository setup)

1. Create gh-pages branch — the first successful publish-helm-chart-repo run will push index.yaml there via cr index --push. The branch does not need to exist beforehand (chart-releaser creates it), but if the push fails due to branch protection, create an empty gh-pages branch manually.
2. Enable GitHub Pages — Settings → Pages → Source: branch gh-pages, folder / (root). This can only be done after gh-pages exists.
3. Org policy — confirm the org allows Pages for this repo (some orgs restrict it).

Verification on first release tag

4. Push a version tag (vX.Y.Z) and confirm the publish-helm-chart-repo job succeeds in Actions.
5. Verify two release surfaces:
   • Tag release (draft): contains crds.yaml, operator.yaml, samples.yaml (no .tgz).
   • Chart Releaser release (<chart-name>-<version>): contains the chart .tgz; index.yaml on gh-pages references it.
6. Smoke test:

   helm repo add coraza-kubernetes-operator \
     https://networking-incubator.github.io/coraza-kubernetes-operator/
   helm repo update
   helm search repo coraza-kubernetes-operator

Test plan

• Push a test tag on a fork and confirm the workflow runs end-to-end
• Verify gh-pages branch is created/updated with index.yaml
• Verify helm repo add + helm search repo returns the chart
• Verify the tag release no longer contains the .tgz (only manifests)
• Verify pre-release tags set mark_as_latest: false

[Copilot]

Pull request overview

Automates publishing the Helm chart as a GitHub Pages-hosted Helm repository on version tags, using helm/chart-releaser-action as part of the existing release workflow.

Changes:

• Add a publish-helm-chart-repo job to package the chart and run chart-releaser (upload + index update to gh-pages).
• Stop attaching dist/*.tgz to the version-tag GitHub release so chart-releaser is the sole publisher of the chart asset.
• Add .cr.yaml configuration and document helm repo add installation via GitHub Pages in the chart README.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
charts/coraza-kubernetes-operator/README.md	Documents installing the chart from a GitHub Pages Helm repo.
.github/workflows/release.yml	Adds chart-repo publishing job and removes .tgz from the tag release assets.
.cr.yaml	Configures chart-releaser to push the Helm index to the gh-pages branch.

[Copilot]

make release.manifests runs helm.sync (which can modify tracked chart files). If the repo ends up with a dirty working tree, chart-releaser’s cr index --push step can fail when switching branches (or accidentally include unrelated changes). It would be safer to assert the tree is clean after packaging (and fail early if not), or otherwise ensure the packaging step doesn’t leave local modifications before invoking chart-releaser.

Suggested change

	make release.manifests
	make release.manifests
	# Ensure no tracked files were modified by packaging (e.g., via helm.sync)
	if [[ -n "$(git status --porcelain --untracked-files=no)" ]]; then
	echo "::error::Working tree is dirty after 'make release.manifests'. Aborting chart release."
	echo "Modified tracked files:"
	git status --porcelain --untracked-files=no
	echo "Diff:"
	git diff
	exit 1
	fi

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.