From 34404d68942b186b5369356101a710ae44465b98 Mon Sep 17 00:00:00 2001
From: Spencer Cai <jiahao.cai@dynamia.ai>
Date: Wed, 15 Jul 2026 18:46:06 +0800
Subject: [PATCH 1/9] ci(helm): add chart release workflows

Signed-off-by: Spencer Cai <jiahao.cai@dynamia.ai>
---
 .github/workflows/build-helm-release.yaml     | 207 ++++++++++++++++
 .github/workflows/helm-lint.yaml              |  85 +++++++
 Makefile                                      |  14 +-
 charts/ascend-device-plugin/README.md         |  52 +++-
 charts/ascend-device-plugin/README.md.gotmpl  |  86 +++++++
 .../ascend-device-plugin/values.schema.json   | 227 ++++++++++++++++++
 charts/ascend-device-plugin/values.yaml       |  88 +++++++
 7 files changed, 757 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/build-helm-release.yaml
 create mode 100644 .github/workflows/helm-lint.yaml
 create mode 100644 charts/ascend-device-plugin/README.md.gotmpl
 create mode 100644 charts/ascend-device-plugin/values.schema.json

diff --git a/.github/workflows/build-helm-release.yaml b/.github/workflows/build-helm-release.yaml
new file mode 100644
index 0000000..af355d2
--- /dev/null
+++ b/.github/workflows/build-helm-release.yaml
@@ -0,0 +1,207 @@
+name: Helm Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - charts/ascend-device-plugin/Chart.yaml
+
+env:
+  HELM_VERSION: "v3.20.0"
+  CHART_PATH: charts/ascend-device-plugin
+
+concurrency:
+  group: helm-release
+  cancel-in-progress: false
+
+jobs:
+  detect-chart-version:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    outputs:
+      version_changed: ${{ steps.compare.outputs.version_changed }}
+      previous_version: ${{ steps.compare.outputs.previous_version }}
+      current_version: ${{ steps.compare.outputs.current_version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Compare chart version
+        id: compare
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          before_sha="${{ github.event.before }}"
+          if [[ -z "${before_sha}" || "${before_sha}" == "0000000000000000000000000000000000000000" ]]; then
+            echo "github.event.before is not available for this push" >&2
+            exit 1
+          fi
+
+          current_version="$(awk '$1 == "version:" { print $2; exit }' "${{ env.CHART_PATH }}/Chart.yaml")"
+          if [[ -z "${current_version}" ]]; then
+            echo "failed to resolve current chart version from ${{ env.CHART_PATH }}/Chart.yaml" >&2
+            exit 1
+          fi
+
+          if git cat-file -e "${before_sha}:${{ env.CHART_PATH }}/Chart.yaml" 2>/dev/null; then
+            previous_version="$(git show "${before_sha}:${{ env.CHART_PATH }}/Chart.yaml" | awk '$1 == "version:" { print $2; exit }')"
+          else
+            previous_version=""
+          fi
+
+          if [[ -z "${previous_version}" || "${previous_version}" != "${current_version}" ]]; then
+            version_changed=true
+          else
+            version_changed=false
+          fi
+
+          {
+            echo "previous_version=${previous_version}"
+            echo "current_version=${current_version}"
+            echo "version_changed=${version_changed}"
+          } >>"$GITHUB_OUTPUT"
+
+  helm-release-push:
+    if: github.event_name == 'push' && needs.detect-chart-version.outputs.version_changed == 'true'
+    needs:
+      - detect-chart-version
+    permissions:
+      contents: write
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Ensure gh-pages branch exists
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if git ls-remote --exit-code --heads origin gh-pages >/dev/null 2>&1; then
+            echo "origin/gh-pages already exists"
+            exit 0
+          fi
+
+          workdir="$(mktemp -d)"
+          git worktree add --detach "${workdir}" HEAD
+
+          pushd "${workdir}"
+          git switch --orphan gh-pages
+          git rm -rf . >/dev/null 2>&1 || true
+          touch .nojekyll
+          git add .nojekyll
+          git commit -m "chore: initialize gh-pages branch"
+          git push origin gh-pages
+          popd
+
+          git worktree remove --force "${workdir}"
+          git fetch origin gh-pages
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5.0.0
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.6.0
+        with:
+          charts_dir: charts
+        env:
+          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Package Helm chart for GHCR
+        run: |
+          mkdir -p dist
+          helm package "${{ env.CHART_PATH }}" --destination dist
+
+      - name: Push Helm chart to GHCR
+        shell: bash
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          namespace="${GITHUB_REPOSITORY_OWNER,,}"
+          echo "${GHCR_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
+          helm push dist/*.tgz "oci://ghcr.io/${namespace}/charts"
+
+  helm-release-manual:
+    if: github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: write
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Ensure gh-pages branch exists
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if git ls-remote --exit-code --heads origin gh-pages >/dev/null 2>&1; then
+            echo "origin/gh-pages already exists"
+            exit 0
+          fi
+
+          workdir="$(mktemp -d)"
+          git worktree add --detach "${workdir}" HEAD
+
+          pushd "${workdir}"
+          git switch --orphan gh-pages
+          git rm -rf . >/dev/null 2>&1 || true
+          touch .nojekyll
+          git add .nojekyll
+          git commit -m "chore: initialize gh-pages branch"
+          git push origin gh-pages
+          popd
+
+          git worktree remove --force "${workdir}"
+          git fetch origin gh-pages
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5.0.0
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.6.0
+        with:
+          charts_dir: charts
+        env:
+          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Package Helm chart for GHCR
+        run: |
+          mkdir -p dist
+          helm package "${{ env.CHART_PATH }}" --destination dist
+
+      - name: Push Helm chart to GHCR
+        shell: bash
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          namespace="${GITHUB_REPOSITORY_OWNER,,}"
+          echo "${GHCR_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
+          helm push dist/*.tgz "oci://ghcr.io/${namespace}/charts"
diff --git a/.github/workflows/helm-lint.yaml b/.github/workflows/helm-lint.yaml
new file mode 100644
index 0000000..6d69046
--- /dev/null
+++ b/.github/workflows/helm-lint.yaml
@@ -0,0 +1,85 @@
+name: Helm Lint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+env:
+  HELM_VERSION: "v3.20.0"
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      helm: ${{ steps.filter.outputs.helm }}
+    steps:
+      - name: Detect Helm changes
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            helm:
+              - 'charts/ascend-device-plugin/**'
+              - 'Makefile'
+              - '.github/workflows/helm-lint.yaml'
+              - '.github/workflows/build-helm-release.yaml'
+
+  lint-test:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.helm == 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5.0.0
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Set up helm-docs
+        uses: gabe565/setup-helm-docs-action@v1
+        with:
+          version: v1.14.2
+
+      - name: Run Helm chart verification
+        run: make verify-helm-chart
+
+  helm-lint-required:
+    runs-on: ubuntu-latest
+    needs:
+      - changes
+      - lint-test
+    if: always()
+    steps:
+      - name: Check Helm workflow result
+        shell: bash
+        run: |
+          if [[ "${{ needs.changes.result }}" != "success" ]]; then
+            echo "Helm change detection did not complete successfully: ${{ needs.changes.result }}"
+            exit 1
+          fi
+
+          if [[ "${{ needs.changes.outputs.helm }}" != "true" ]]; then
+            echo "No Helm-relevant changes."
+            exit 0
+          fi
+
+          if [[ "${{ needs.lint-test.result }}" != "success" ]]; then
+            echo "Helm verification did not complete successfully: ${{ needs.lint-test.result }}"
+            exit 1
+          fi
diff --git a/Makefile b/Makefile
index 1bb2037..163dde8 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,19 @@ lint:
 ascend-device-plugin:
 	$(GO) build $(BUILDARGS) -o ./ascend-device-plugin ./cmd/main.go
 
+.PHONY: update-chart-docs
+update-chart-docs:
+	cd charts/ascend-device-plugin && helm-docs --skip-version-footer
+	cd charts/ascend-device-plugin && $(GO) run github.com/losisin/helm-values-schema-json@v1.9.2 -input values.yaml -output values.schema.json
+
+.PHONY: verify-helm-chart
+verify-helm-chart:
+	$(MAKE) update-chart-docs
+	git diff --exit-code -- charts/ascend-device-plugin/README.md charts/ascend-device-plugin/values.schema.json
+	helm lint charts/ascend-device-plugin
+	helm template ascend-device-plugin charts/ascend-device-plugin >/dev/null
+
 clean:
 	rm -rf ./ascend-device-plugin
 
-.PHONY: all tidy test lint clean
\ No newline at end of file
+.PHONY: all tidy test lint clean update-chart-docs verify-helm-chart
diff --git a/charts/ascend-device-plugin/README.md b/charts/ascend-device-plugin/README.md
index 82c9b29..276e9b6 100644
--- a/charts/ascend-device-plugin/README.md
+++ b/charts/ascend-device-plugin/README.md
@@ -1,4 +1,8 @@
-# Ascend Device Plugin Helm Chart
+# ascend-device-plugin
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)  ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)  ![AppVersion: v1.3.0](https://img.shields.io/badge/AppVersion-v1.3.0-informational?style=flat-square)
+
+HAMi Ascend device plugin
 
 This chart deploys the standalone HAMi Ascend device plugin manifests:
 
@@ -65,3 +69,49 @@ nodeConfig: |-
       hami-vnpu-core: true
       vDeviceCount: 8
 ```
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| config.create | bool | `true` | Create the device configuration ConfigMap. |
+| config.deviceConfigMapName | string | `"hami-scheduler-device"` | Name of the chart-managed device configuration ConfigMap. |
+| config.existingDeviceConfigMapName | string | `""` | Existing device configuration ConfigMap to mount instead of the chart-managed ConfigMap. |
+| daemonSet.name | string | `"hami-ascend-device-plugin"` | Device plugin DaemonSet name. |
+| fullnameOverride | string | `""` | Override the fully qualified resource name. |
+| hamiVnpuCore.enabled | bool | `false` | Enable hami-vnpu-core in the generated global device configuration. |
+| image.pullPolicy | string | `"IfNotPresent"` | Kubernetes image pull policy. |
+| image.repository | string | `"projecthami/ascend-device-plugin"` | Container image repository. |
+| image.tag | string | `""` | Container image tag. Defaults to the chart `appVersion` when empty. |
+| nameOverride | string | `""` | Override the chart name used in resource names. |
+| nodeConfig | string | `"nodes: []"` | Per-node hami-vnpu-core configuration written to the node ConfigMap. |
+| nodeConfigMap.create | bool | `true` | Create the per-node configuration ConfigMap. |
+| nodeConfigMap.name | string | `"hami-device-node-config"` | Per-node configuration ConfigMap name. |
+| nodeSelector.ascend | string | `"on"` | Node label value used to schedule the device plugin. |
+| rbac.name | string | `"hami-ascend"` | Name shared by the chart-managed RBAC resources. |
+| resources.limits.cpu | string | `"500m"` | CPU limit for the device plugin container. |
+| resources.limits.memory | string | `"500Mi"` | Memory limit for the device plugin container. |
+| resources.requests.cpu | string | `"500m"` | Requested CPU for the device plugin container. |
+| resources.requests.memory | string | `"500Mi"` | Requested memory for the device plugin container. |
+| runtimeClass.create | bool | `true` | Create the Ascend RuntimeClass. |
+| runtimeClass.handler | string | `"ascend"` | Container runtime handler used by the RuntimeClass. |
+| runtimeClass.name | string | `"ascend"` | RuntimeClass resource name. |
+| serviceAccount.create | bool | `true` | Create a ServiceAccount for the device plugin. |
+| serviceAccount.name | string | `"hami-ascend"` | ServiceAccount name. Defaults to the chart fullname when empty and creation is enabled. |
+| vnpuMonitor.enabled | bool | `false` | Create vNPU monitoring integration resources. |
+| vnpuMonitor.prometheusRule.create | bool | `true` | Create a Prometheus Operator PrometheusRule. |
+| vnpuMonitor.prometheusRule.groupLabels.vendor | string | `"ascend"` | Vendor label applied to the Prometheus rule group. |
+| vnpuMonitor.prometheusRule.groupName | string | `"ascend-vnpu"` | Prometheus rule group name. |
+| vnpuMonitor.prometheusRule.interval | string | `"15s"` | Prometheus rule evaluation interval. |
+| vnpuMonitor.prometheusRule.labels.release | string | `"prometheus"` | Prometheus release label applied to the PrometheusRule. |
+| vnpuMonitor.prometheusRule.labels.role | string | `"recording-rules"` | Role label applied to the PrometheusRule. |
+| vnpuMonitor.prometheusRule.labels.vendor | string | `"ascend"` | Vendor label applied to the PrometheusRule. |
+| vnpuMonitor.prometheusRule.name | string | `"hami-ascend-vnpu-monitor"` | PrometheusRule name. |
+| vnpuMonitor.prometheusRule.namespace | string | `"monitoring"` | Namespace in which to create the PrometheusRule. |
+| vnpuMonitor.service.name | string | `"hami-ascend-device-plugin-metrics"` | Metrics Service name. |
+| vnpuMonitor.serviceMonitor.create | bool | `true` | Create a Prometheus Operator ServiceMonitor. |
+| vnpuMonitor.serviceMonitor.interval | string | `"15s"` | Metrics scrape interval. |
+| vnpuMonitor.serviceMonitor.labels.release | string | `"prometheus"` | Prometheus release label applied to the ServiceMonitor. |
+| vnpuMonitor.serviceMonitor.name | string | `"hami-ascend-vnpu-monitor"` | ServiceMonitor name. |
+| vnpuMonitor.serviceMonitor.namespace | string | `"monitoring"` | Namespace in which to create the ServiceMonitor. |
+| vnpuMonitor.serviceMonitor.path | string | `"/metrics"` | Metrics HTTP path. |
diff --git a/charts/ascend-device-plugin/README.md.gotmpl b/charts/ascend-device-plugin/README.md.gotmpl
new file mode 100644
index 0000000..0e46e8b
--- /dev/null
+++ b/charts/ascend-device-plugin/README.md.gotmpl
@@ -0,0 +1,86 @@
+{{ template "chart.header" . }}
+
+{{ template "chart.versionBadge" . }} {{ template "chart.typeBadge" . }} {{ template "chart.appVersionBadge" . }}
+
+{{ template "chart.description" . }}
+
+This chart deploys the standalone HAMi Ascend device plugin manifests:
+
+- RuntimeClass
+- ConfigMaps
+- RBAC and ServiceAccount
+- Device plugin DaemonSet
+- (Optional) vNPU monitor integration resources (Service, ServiceMonitor, PrometheusRule)
+
+## Install
+
+Label Ascend nodes before installing:
+
+```bash
+kubectl label node <ascend-node> ascend=on --overwrite
+```
+
+Install the chart:
+
+```bash
+helm install ascend-device-plugin ./charts/ascend-device-plugin \
+  --namespace kube-system \
+  --set image.tag=v1.3.0
+```
+
+If the HAMi chart already manages the Ascend device plugin DaemonSet, related ConfigMaps, RBAC, or RuntimeClass, do not deploy this standalone chart at the same time.
+
+## Existing Device Configuration
+
+If another chart, such as the HAMi chart, already owns the shared `hami-scheduler-device` ConfigMap, reuse it instead of creating another one:
+
+```bash
+helm install ascend-device-plugin ./charts/ascend-device-plugin \
+  --namespace kube-system \
+  --set image.tag=v1.3.0 \
+  --set config.create=false \
+  --set config.existingDeviceConfigMapName=hami-scheduler-device
+```
+
+With this mode, the chart mounts the existing device config and still manages `hami-device-node-config` by default.
+
+## hami-vnpu-core
+
+Enable the global `vnpus.hamiVnpuCore` switch in the generated device config:
+
+```bash
+helm install ascend-device-plugin ./charts/ascend-device-plugin \
+  --namespace kube-system \
+  --set image.tag=v1.3.0 \
+  --set hamiVnpuCore.enabled=true
+```
+
+## vNPU Monitor Integration
+
+The chart can also create the resources from `ascend-vnpu-monitor-integration.yaml`.
+
+- `vnpuMonitor.enabled=true` creates the metrics `Service`.
+- `ServiceMonitor` and `PrometheusRule` are created by default; ensure Prometheus Operator CRDs are installed first.
+- You can disable either one with `vnpuMonitor.serviceMonitor.create=false` or `vnpuMonitor.prometheusRule.create=false`.
+
+```bash
+helm install ascend-device-plugin ./charts/ascend-device-plugin \
+  --namespace kube-system \
+  --set image.tag=v1.3.0 \
+  --set hamiVnpuCore.enabled=true \
+  --set vnpuMonitor.enabled=true
+```
+
+## Node Configuration
+
+Override `nodeConfig` to enable or customize `hami-vnpu-core` per node:
+
+```yaml
+nodeConfig: |-
+  nodes:
+    - name: "ascend-node-1"
+      hami-vnpu-core: true
+      vDeviceCount: 8
+```
+
+{{ template "chart.valuesSection" . }}
diff --git a/charts/ascend-device-plugin/values.schema.json b/charts/ascend-device-plugin/values.schema.json
new file mode 100644
index 0000000..000a010
--- /dev/null
+++ b/charts/ascend-device-plugin/values.schema.json
@@ -0,0 +1,227 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "object",
+    "properties": {
+        "config": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean"
+                },
+                "deviceConfigMapName": {
+                    "type": "string"
+                },
+                "existingDeviceConfigMapName": {
+                    "type": "string"
+                }
+            }
+        },
+        "daemonSet": {
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
+        "deviceConfig": {
+            "type": "string"
+        },
+        "fullnameOverride": {
+            "type": "string"
+        },
+        "hamiVnpuCore": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                }
+            }
+        },
+        "image": {
+            "type": "object",
+            "properties": {
+                "pullPolicy": {
+                    "type": "string"
+                },
+                "repository": {
+                    "type": "string"
+                },
+                "tag": {
+                    "type": "string"
+                }
+            }
+        },
+        "nameOverride": {
+            "type": "string"
+        },
+        "nodeConfig": {
+            "type": "string"
+        },
+        "nodeConfigMap": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean"
+                },
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
+        "nodeSelector": {
+            "type": "object",
+            "properties": {
+                "ascend": {
+                    "type": "string"
+                }
+            }
+        },
+        "rbac": {
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
+        "resources": {
+            "type": "object",
+            "properties": {
+                "limits": {
+                    "type": "object",
+                    "properties": {
+                        "cpu": {
+                            "type": "string"
+                        },
+                        "memory": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "requests": {
+                    "type": "object",
+                    "properties": {
+                        "cpu": {
+                            "type": "string"
+                        },
+                        "memory": {
+                            "type": "string"
+                        }
+                    }
+                }
+            }
+        },
+        "runtimeClass": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean"
+                },
+                "handler": {
+                    "type": "string"
+                },
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
+        "serviceAccount": {
+            "type": "object",
+            "properties": {
+                "create": {
+                    "type": "boolean"
+                },
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
+        "vnpuMonitor": {
+            "type": "object",
+            "properties": {
+                "enabled": {
+                    "type": "boolean"
+                },
+                "prometheusRule": {
+                    "type": "object",
+                    "properties": {
+                        "create": {
+                            "type": "boolean"
+                        },
+                        "groupLabels": {
+                            "type": "object",
+                            "properties": {
+                                "vendor": {
+                                    "type": "string"
+                                }
+                            }
+                        },
+                        "groupName": {
+                            "type": "string"
+                        },
+                        "interval": {
+                            "type": "string"
+                        },
+                        "labels": {
+                            "type": "object",
+                            "properties": {
+                                "release": {
+                                    "type": "string"
+                                },
+                                "role": {
+                                    "type": "string"
+                                },
+                                "vendor": {
+                                    "type": "string"
+                                }
+                            }
+                        },
+                        "name": {
+                            "type": "string"
+                        },
+                        "namespace": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "service": {
+                    "type": "object",
+                    "properties": {
+                        "name": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "serviceMonitor": {
+                    "type": "object",
+                    "properties": {
+                        "create": {
+                            "type": "boolean"
+                        },
+                        "interval": {
+                            "type": "string"
+                        },
+                        "labels": {
+                            "type": "object",
+                            "properties": {
+                                "release": {
+                                    "type": "string"
+                                }
+                            }
+                        },
+                        "name": {
+                            "type": "string"
+                        },
+                        "namespace": {
+                            "type": "string"
+                        },
+                        "path": {
+                            "type": "string"
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/charts/ascend-device-plugin/values.yaml b/charts/ascend-device-plugin/values.yaml
index 68b973a..4735fb9 100644
--- a/charts/ascend-device-plugin/values.yaml
+++ b/charts/ascend-device-plugin/values.yaml
@@ -1,12 +1,21 @@
 image:
+  # image.repository -- Container image repository.
   repository: projecthami/ascend-device-plugin
+
+  # image.tag -- Container image tag. Defaults to the chart `appVersion` when empty.
   tag: ""
+
+  # image.pullPolicy -- Kubernetes image pull policy.
   pullPolicy: IfNotPresent
 
+# nameOverride -- Override the chart name used in resource names.
 nameOverride: ""
+
+# fullnameOverride -- Override the fully qualified resource name.
 fullnameOverride: ""
 
 daemonSet:
+  # daemonSet.name -- Device plugin DaemonSet name.
   name: hami-ascend-device-plugin
   args:
     - --config_file
@@ -14,40 +23,118 @@ daemonSet:
     - --v=4
 
 rbac:
+  # rbac.name -- Name shared by the chart-managed RBAC resources.
   name: hami-ascend
 
 runtimeClass:
+  # runtimeClass.create -- Create the Ascend RuntimeClass.
   create: true
+
+  # runtimeClass.name -- RuntimeClass resource name.
   name: ascend
+
+  # runtimeClass.handler -- Container runtime handler used by the RuntimeClass.
   handler: ascend
 
 serviceAccount:
+  # serviceAccount.create -- Create a ServiceAccount for the device plugin.
   create: true
+
+  # serviceAccount.name -- ServiceAccount name. Defaults to the chart fullname when empty and creation is enabled.
   name: hami-ascend
 
 nodeSelector:
+  # nodeSelector.ascend -- Node label value used to schedule the device plugin.
   ascend: "on"
 
 resources:
   requests:
+    # resources.requests.memory -- Requested memory for the device plugin container.
     memory: 500Mi
+
+    # resources.requests.cpu -- Requested CPU for the device plugin container.
     cpu: 500m
   limits:
+    # resources.limits.memory -- Memory limit for the device plugin container.
     memory: 500Mi
+
+    # resources.limits.cpu -- CPU limit for the device plugin container.
     cpu: 500m
 
 config:
+  # config.create -- Create the device configuration ConfigMap.
   create: true
+
+  # config.existingDeviceConfigMapName -- Existing device configuration ConfigMap to mount instead of the chart-managed ConfigMap.
   existingDeviceConfigMapName: ""
+
+  # config.deviceConfigMapName -- Name of the chart-managed device configuration ConfigMap.
   deviceConfigMapName: hami-scheduler-device
 
 nodeConfigMap:
+  # nodeConfigMap.create -- Create the per-node configuration ConfigMap.
   create: true
+
+  # nodeConfigMap.name -- Per-node configuration ConfigMap name.
   name: hami-device-node-config
 
 hamiVnpuCore:
+  # hamiVnpuCore.enabled -- Enable hami-vnpu-core in the generated global device configuration.
   enabled: false
 
+vnpuMonitor:
+  # vnpuMonitor.enabled -- Create vNPU monitoring integration resources.
+  enabled: false
+  service:
+    # vnpuMonitor.service.name -- Metrics Service name.
+    name: hami-ascend-device-plugin-metrics
+  serviceMonitor:
+    # vnpuMonitor.serviceMonitor.create -- Create a Prometheus Operator ServiceMonitor.
+    create: true
+
+    # vnpuMonitor.serviceMonitor.name -- ServiceMonitor name.
+    name: hami-ascend-vnpu-monitor
+
+    # vnpuMonitor.serviceMonitor.namespace -- Namespace in which to create the ServiceMonitor.
+    namespace: monitoring
+    labels:
+      # vnpuMonitor.serviceMonitor.labels.release -- Prometheus release label applied to the ServiceMonitor.
+      release: prometheus
+
+    # vnpuMonitor.serviceMonitor.interval -- Metrics scrape interval.
+    interval: 15s
+
+    # vnpuMonitor.serviceMonitor.path -- Metrics HTTP path.
+    path: /metrics
+  prometheusRule:
+    # vnpuMonitor.prometheusRule.create -- Create a Prometheus Operator PrometheusRule.
+    create: true
+
+    # vnpuMonitor.prometheusRule.name -- PrometheusRule name.
+    name: hami-ascend-vnpu-monitor
+
+    # vnpuMonitor.prometheusRule.namespace -- Namespace in which to create the PrometheusRule.
+    namespace: monitoring
+    labels:
+      # vnpuMonitor.prometheusRule.labels.release -- Prometheus release label applied to the PrometheusRule.
+      release: prometheus
+
+      # vnpuMonitor.prometheusRule.labels.role -- Role label applied to the PrometheusRule.
+      role: recording-rules
+
+      # vnpuMonitor.prometheusRule.labels.vendor -- Vendor label applied to the PrometheusRule.
+      vendor: ascend
+
+    # vnpuMonitor.prometheusRule.groupName -- Prometheus rule group name.
+    groupName: ascend-vnpu
+
+    # vnpuMonitor.prometheusRule.interval -- Prometheus rule evaluation interval.
+    interval: 15s
+    groupLabels:
+      # vnpuMonitor.prometheusRule.groupLabels.vendor -- Vendor label applied to the Prometheus rule group.
+      vendor: ascend
+
+ # @ignored
 deviceConfig: |-
   vnpus:
     hamiVnpuCore: {{ .Values.hamiVnpuCore.enabled }}
@@ -176,5 +263,6 @@ deviceConfig: |-
       aiCore: 20
       aiCPU: 7
 
+# nodeConfig -- Per-node hami-vnpu-core configuration written to the node ConfigMap.
 nodeConfig: |-
   nodes: []

From 89659adb1037f27c0ac7d9ca8e6767d43c8f1c56 Mon Sep 17 00:00:00 2001
From: Spencer Cai <jiahao.cai@dynamia.ai>
Date: Wed, 15 Jul 2026 18:54:57 +0800
Subject: [PATCH 2/9] chore: add .gitignore

Signed-off-by: Spencer Cai <jiahao.cai@dynamia.ai>
---
 .gitignore | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..6144afb
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,75 @@
+### Linux template
+*~
+
+# temporary files which can be created if a process still has a handle open of a deleted file
+.fuse_hidden*
+
+# KDE directory preferences
+.directory
+
+# Linux trash folder which might appear on any partition or disk
+.Trash-*
+
+# .nfs files are created when an open file is removed but is still being accessed
+.nfs*
+
+### Go template
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# env file
+.env
+
+### macOS template
+# General
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# Icon must end with two \r
+Icon
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+
+### Custom
+.idea/
+.vscode/
+.worktree/

From 30632180611116a4446a17fa567d4b1f42011f50 Mon Sep 17 00:00:00 2001
From: Spencer Cai <jiahao.cai@dynamia.ai>
Date: Thu, 16 Jul 2026 10:35:43 +0800
Subject: [PATCH 3/9] chore: remove useless comments for helm-docs

Signed-off-by: Spencer Cai <jiahao.cai@dynamia.ai>
---
 charts/ascend-device-plugin/values.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/charts/ascend-device-plugin/values.yaml b/charts/ascend-device-plugin/values.yaml
index 4735fb9..e7eb6e5 100644
--- a/charts/ascend-device-plugin/values.yaml
+++ b/charts/ascend-device-plugin/values.yaml
@@ -49,16 +49,10 @@ nodeSelector:
 
 resources:
   requests:
-    # resources.requests.memory -- Requested memory for the device plugin container.
     memory: 500Mi
-
-    # resources.requests.cpu -- Requested CPU for the device plugin container.
     cpu: 500m
   limits:
-    # resources.limits.memory -- Memory limit for the device plugin container.
     memory: 500Mi
-
-    # resources.limits.cpu -- CPU limit for the device plugin container.
     cpu: 500m
 
 config:

From 46982d13395ad25f14d1557b891929a1c3ee2d49 Mon Sep 17 00:00:00 2001
From: Spencer Cai <jiahao.cai@dynamia.ai>
Date: Thu, 16 Jul 2026 11:08:24 +0800
Subject: [PATCH 4/9] ci(helm): consolidate chart release triggers

Signed-off-by: Spencer Cai <jiahao.cai@dynamia.ai>
---
 .github/workflows/build-helm-release.yaml | 109 +++++++---------------
 1 file changed, 36 insertions(+), 73 deletions(-)

diff --git a/.github/workflows/build-helm-release.yaml b/.github/workflows/build-helm-release.yaml
index af355d2..b0c7223 100644
--- a/.github/workflows/build-helm-release.yaml
+++ b/.github/workflows/build-helm-release.yaml
@@ -5,12 +5,15 @@ on:
   push:
     branches:
       - main
+    tags:
+      - "v*"
     paths:
       - charts/ascend-device-plugin/Chart.yaml
 
 env:
   HELM_VERSION: "v3.20.0"
   CHART_PATH: charts/ascend-device-plugin
+  CHART_NAME: ascend-device-plugin
 
 concurrency:
   group: helm-release
@@ -18,7 +21,7 @@ concurrency:
 
 jobs:
   detect-chart-version:
-    if: github.event_name == 'push'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     outputs:
       version_changed: ${{ steps.compare.outputs.version_changed }}
@@ -66,10 +69,14 @@ jobs:
             echo "version_changed=${version_changed}"
           } >>"$GITHUB_OUTPUT"
 
-  helm-release-push:
-    if: github.event_name == 'push' && needs.detect-chart-version.outputs.version_changed == 'true'
+  helm-release:
     needs:
       - detect-chart-version
+    if: >-
+      always() &&
+      (github.event_name == 'workflow_dispatch' ||
+      startsWith(github.ref, 'refs/tags/') ||
+      needs.detect-chart-version.outputs.version_changed == 'true')
     permissions:
       contents: write
       packages: write
@@ -115,93 +122,49 @@ jobs:
         with:
           version: ${{ env.HELM_VERSION }}
 
+      - name: Package Helm chart
+        run: |
+          mkdir -p .cr-release-packages
+          helm package "${{ env.CHART_PATH }}" --destination .cr-release-packages
+
       - name: Run chart-releaser
         uses: helm/chart-releaser-action@v1.6.0
         with:
           charts_dir: charts
+          skip_existing: true
+          skip_packaging: true
         env:
           CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Package Helm chart for GHCR
-        run: |
-          mkdir -p dist
-          helm package "${{ env.CHART_PATH }}" --destination dist
-
-      - name: Push Helm chart to GHCR
+      - name: Publish Helm chart to GHCR
         shell: bash
         env:
           GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          namespace="${GITHUB_REPOSITORY_OWNER,,}"
-          echo "${GHCR_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
-          helm push dist/*.tgz "oci://ghcr.io/${namespace}/charts"
 
-  helm-release-manual:
-    if: github.event_name == 'workflow_dispatch'
-    permissions:
-      contents: write
-      packages: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
+          namespace="${GITHUB_REPOSITORY_OWNER,,}"
+          chart_version="$(awk '$1 == "version:" { print $2; exit }' "${{ env.CHART_PATH }}/Chart.yaml")"
+          package_path=".cr-release-packages/${{ env.CHART_NAME }}-${chart_version}.tgz"
 
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+          if [[ -z "${chart_version}" || ! -f "${package_path}" ]]; then
+            echo "failed to resolve packaged chart for ${{ env.CHART_NAME }}" >&2
+            exit 1
+          fi
 
-      - name: Ensure gh-pages branch exists
-        shell: bash
-        run: |
-          set -euo pipefail
+          echo "${GHCR_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
+          chart_ref="oci://ghcr.io/${namespace}/charts/${{ env.CHART_NAME }}"
+          lookup_error="$(mktemp)"
 
-          if git ls-remote --exit-code --heads origin gh-pages >/dev/null 2>&1; then
-            echo "origin/gh-pages already exists"
+          if helm show chart "${chart_ref}" --version "${chart_version}" >/dev/null 2>"${lookup_error}"; then
+            echo "${chart_ref}:${chart_version} already exists; skipping GHCR push"
             exit 0
           fi
 
-          workdir="$(mktemp -d)"
-          git worktree add --detach "${workdir}" HEAD
-
-          pushd "${workdir}"
-          git switch --orphan gh-pages
-          git rm -rf . >/dev/null 2>&1 || true
-          touch .nojekyll
-          git add .nojekyll
-          git commit -m "chore: initialize gh-pages branch"
-          git push origin gh-pages
-          popd
-
-          git worktree remove --force "${workdir}"
-          git fetch origin gh-pages
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v5.0.0
-        with:
-          version: ${{ env.HELM_VERSION }}
-
-      - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.6.0
-        with:
-          charts_dir: charts
-        env:
-          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Package Helm chart for GHCR
-        run: |
-          mkdir -p dist
-          helm package "${{ env.CHART_PATH }}" --destination dist
+          if ! grep -Eqi 'not found|manifest unknown' "${lookup_error}"; then
+            echo "failed to query ${chart_ref}:${chart_version}" >&2
+            cat "${lookup_error}" >&2
+            exit 1
+          fi
 
-      - name: Push Helm chart to GHCR
-        shell: bash
-        env:
-          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          namespace="${GITHUB_REPOSITORY_OWNER,,}"
-          echo "${GHCR_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
-          helm push dist/*.tgz "oci://ghcr.io/${namespace}/charts"
+          helm push "${package_path}" "oci://ghcr.io/${namespace}/charts"

From d05386b5816282e1a376f479a6d2f38299012840 Mon Sep 17 00:00:00 2001
From: spencercjh <spencercjh@gmail.com>
Date: Tue, 4 Aug 2026 04:05:46 +0000
Subject: [PATCH 5/9] fix(helm): refresh generated chart artifacts

Signed-off-by: spencercjh <spencercjh@gmail.com>
---
 .github/workflows/build-helm-release.yaml      |  3 +++
 .github/workflows/helm-lint.yaml               |  2 ++
 charts/ascend-device-plugin/README.md          | 11 +++++++----
 charts/ascend-device-plugin/values.schema.json |  6 ++++++
 4 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-helm-release.yaml b/.github/workflows/build-helm-release.yaml
index b0c7223..bf4d667 100644
--- a/.github/workflows/build-helm-release.yaml
+++ b/.github/workflows/build-helm-release.yaml
@@ -15,6 +15,9 @@ env:
   CHART_PATH: charts/ascend-device-plugin
   CHART_NAME: ascend-device-plugin
 
+permissions:
+  contents: read
+
 concurrency:
   group: helm-release
   cancel-in-progress: false
diff --git a/.github/workflows/helm-lint.yaml b/.github/workflows/helm-lint.yaml
index 6d69046..cafac9c 100644
--- a/.github/workflows/helm-lint.yaml
+++ b/.github/workflows/helm-lint.yaml
@@ -40,6 +40,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Helm
         uses: azure/setup-helm@v5.0.0
diff --git a/charts/ascend-device-plugin/README.md b/charts/ascend-device-plugin/README.md
index 276e9b6..7f5fc76 100644
--- a/charts/ascend-device-plugin/README.md
+++ b/charts/ascend-device-plugin/README.md
@@ -77,6 +77,9 @@ nodeConfig: |-
 | config.create | bool | `true` | Create the device configuration ConfigMap. |
 | config.deviceConfigMapName | string | `"hami-scheduler-device"` | Name of the chart-managed device configuration ConfigMap. |
 | config.existingDeviceConfigMapName | string | `""` | Existing device configuration ConfigMap to mount instead of the chart-managed ConfigMap. |
+| daemonSet.args[0] | string | `"--config_file"` |  |
+| daemonSet.args[1] | string | `"/device-config.yaml"` |  |
+| daemonSet.args[2] | string | `"--v=4"` |  |
 | daemonSet.name | string | `"hami-ascend-device-plugin"` | Device plugin DaemonSet name. |
 | fullnameOverride | string | `""` | Override the fully qualified resource name. |
 | hamiVnpuCore.enabled | bool | `false` | Enable hami-vnpu-core in the generated global device configuration. |
@@ -89,10 +92,10 @@ nodeConfig: |-
 | nodeConfigMap.name | string | `"hami-device-node-config"` | Per-node configuration ConfigMap name. |
 | nodeSelector.ascend | string | `"on"` | Node label value used to schedule the device plugin. |
 | rbac.name | string | `"hami-ascend"` | Name shared by the chart-managed RBAC resources. |
-| resources.limits.cpu | string | `"500m"` | CPU limit for the device plugin container. |
-| resources.limits.memory | string | `"500Mi"` | Memory limit for the device plugin container. |
-| resources.requests.cpu | string | `"500m"` | Requested CPU for the device plugin container. |
-| resources.requests.memory | string | `"500Mi"` | Requested memory for the device plugin container. |
+| resources.limits.cpu | string | `"500m"` |  |
+| resources.limits.memory | string | `"500Mi"` |  |
+| resources.requests.cpu | string | `"500m"` |  |
+| resources.requests.memory | string | `"500Mi"` |  |
 | runtimeClass.create | bool | `true` | Create the Ascend RuntimeClass. |
 | runtimeClass.handler | string | `"ascend"` | Container runtime handler used by the RuntimeClass. |
 | runtimeClass.name | string | `"ascend"` | RuntimeClass resource name. |
diff --git a/charts/ascend-device-plugin/values.schema.json b/charts/ascend-device-plugin/values.schema.json
index 000a010..6de7e21 100644
--- a/charts/ascend-device-plugin/values.schema.json
+++ b/charts/ascend-device-plugin/values.schema.json
@@ -19,6 +19,12 @@
         "daemonSet": {
             "type": "object",
             "properties": {
+                "args": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
                 "name": {
                     "type": "string"
                 }

From 62c9904ad403d07e2085db00f9e78cee5ecc7d73 Mon Sep 17 00:00:00 2001
From: spencercjh <spencercjh@gmail.com>
Date: Tue, 4 Aug 2026 04:53:05 +0000
Subject: [PATCH 6/9] docs(helm): refresh generated chart reference

Signed-off-by: spencercjh <spencercjh@gmail.com>
---
 charts/ascend-device-plugin/README.md | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/charts/ascend-device-plugin/README.md b/charts/ascend-device-plugin/README.md
index 7f5fc76..565ea51 100644
--- a/charts/ascend-device-plugin/README.md
+++ b/charts/ascend-device-plugin/README.md
@@ -1,6 +1,6 @@
 # ascend-device-plugin
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)  ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)  ![AppVersion: v1.3.0](https://img.shields.io/badge/AppVersion-v1.3.0-informational?style=flat-square)
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)  ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)  ![AppVersion: v1.4.0](https://img.shields.io/badge/AppVersion-v1.4.0-informational?style=flat-square)
 
 HAMi Ascend device plugin
 
@@ -10,6 +10,7 @@ This chart deploys the standalone HAMi Ascend device plugin manifests:
 - ConfigMaps
 - RBAC and ServiceAccount
 - Device plugin DaemonSet
+- (Optional) vNPU monitor integration resources (Service, ServiceMonitor, PrometheusRule)
 
 ## Install
 
@@ -24,7 +25,7 @@ Install the chart:
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
   --namespace kube-system \
-  --set image.tag=v1.4.0
+  --set image.tag=v1.3.0
 ```
 
 If the HAMi chart already manages the Ascend device plugin DaemonSet, related ConfigMaps, RBAC, or RuntimeClass, do not deploy this standalone chart at the same time.
@@ -36,7 +37,7 @@ If another chart, such as the HAMi chart, already owns the shared `hami-schedule
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
   --namespace kube-system \
-  --set image.tag=v1.4.0 \
+  --set image.tag=v1.3.0 \
   --set config.create=false \
   --set config.existingDeviceConfigMapName=hami-scheduler-device
 ```
@@ -50,13 +51,25 @@ Enable the global `vnpus.hamiVnpuCore` switch in the generated device config:
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
   --namespace kube-system \
-  --set image.tag=v1.4.0 \
+  --set image.tag=v1.3.0 \
   --set hamiVnpuCore.enabled=true
 ```
 
-## Monitoring
+## vNPU Monitor Integration
 
-In `hami-vnpu-core` (soft slicing) mode, the device plugin exposes Prometheus-format metrics on `:9395/metrics` (container port `monitorport`). Wiring this up to your own Prometheus (Service, ServiceMonitor/PodMonitor, alerting/recording rules, etc.) is outside the scope of this chart — point your monitoring stack at that port however it expects.
+The chart can also create the resources from `ascend-vnpu-monitor-integration.yaml`.
+
+- `vnpuMonitor.enabled=true` creates the metrics `Service`.
+- `ServiceMonitor` and `PrometheusRule` are created by default; ensure Prometheus Operator CRDs are installed first.
+- You can disable either one with `vnpuMonitor.serviceMonitor.create=false` or `vnpuMonitor.prometheusRule.create=false`.
+
+```bash
+helm install ascend-device-plugin ./charts/ascend-device-plugin \
+  --namespace kube-system \
+  --set image.tag=v1.3.0 \
+  --set hamiVnpuCore.enabled=true \
+  --set vnpuMonitor.enabled=true
+```
 
 ## Node Configuration
 
@@ -81,6 +94,7 @@ nodeConfig: |-
 | daemonSet.args[1] | string | `"/device-config.yaml"` |  |
 | daemonSet.args[2] | string | `"--v=4"` |  |
 | daemonSet.name | string | `"hami-ascend-device-plugin"` | Device plugin DaemonSet name. |
+| deviceConfig | string | `"vnpus:\n  hamiVnpuCore: {{ .Values.hamiVnpuCore.enabled }}\n  configs:\n  - chipName: 910A\n    commonWord: Ascend910A\n    resourceName: huawei.com/Ascend910A\n    resourceMemoryName: huawei.com/Ascend910A-memory\n    memoryAllocatable: 32768\n    memoryCapacity: 32768\n    aiCore: 30\n    templates:\n      - name: vir02\n        memory: 2184\n        aiCore: 2\n      - name: vir04\n        memory: 4369\n        aiCore: 4\n      - name: vir08\n        memory: 8738\n        aiCore: 8\n      - name: vir16\n        memory: 17476\n        aiCore: 16\n  - chipName: 910B2\n    commonWord: Ascend910B2\n    resourceName: huawei.com/Ascend910B2\n    resourceMemoryName: huawei.com/Ascend910B2-memory\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 24\n    aiCPU: 6\n    templates:\n      - name: vir03_1c_8g\n        memory: 8192\n        aiCore: 3\n        aiCPU: 1\n      - name: vir06_1c_16g\n        memory: 16384\n        aiCore: 6\n        aiCPU: 1\n      - name: vir12_3c_32g\n        memory: 32768\n        aiCore: 12\n        aiCPU: 3\n  - chipName: 910B3\n    commonWord: Ascend910B3\n    resourceName: huawei.com/Ascend910B3\n    resourceMemoryName: huawei.com/Ascend910B3-memory\n    resourceCoreName: huawei.com/Ascend910B3-core\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_16g\n        memory: 16384\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_32g\n        memory: 32768\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 910B4-1\n    commonWord: Ascend910B4-1\n    resourceName: huawei.com/Ascend910B4-1\n    resourceMemoryName: huawei.com/Ascend910B4-1-memory\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_16g\n        memory: 16384\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_32g\n        memory: 32768\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 910B4\n    commonWord: Ascend910B4\n    resourceName: huawei.com/Ascend910B4\n    resourceMemoryName: huawei.com/Ascend910B4-memory\n    memoryAllocatable: 32768\n    memoryCapacity: 32768\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_8g\n        memory: 8192\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_16g\n        memory: 16384\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 310P3\n    commonWord: Ascend310P\n    resourceName: huawei.com/Ascend310P\n    resourceMemoryName: huawei.com/Ascend310P-memory\n    memoryAllocatable: 21527\n    memoryCapacity: 24576\n    aiCore: 8\n    aiCPU: 7\n    templates:\n      - name: vir01\n        memory: 3072\n        aiCore: 1\n        aiCPU: 1\n      - name: vir02\n        memory: 6144\n        aiCore: 2\n        aiCPU: 2\n      - name: vir04\n        memory: 12288\n        aiCore: 4\n        aiCPU: 4\n  - chipName: Ascend910\n    commonWord: Ascend910C\n    resourceName: huawei.com/Ascend910C\n    resourceMemoryName: huawei.com/Ascend910C-memory\n    resourceCoreName: huawei.com/Ascend910C-core\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7"` |  |
 | fullnameOverride | string | `""` | Override the fully qualified resource name. |
 | hamiVnpuCore.enabled | bool | `false` | Enable hami-vnpu-core in the generated global device configuration. |
 | image.pullPolicy | string | `"IfNotPresent"` | Kubernetes image pull policy. |

From 5ad8c2bb67adcd1598f9949f1ecb7c518b707db3 Mon Sep 17 00:00:00 2001
From: spencercjh <spencercjh@gmail.com>
Date: Tue, 4 Aug 2026 05:30:23 +0000
Subject: [PATCH 7/9] fix(helm): align chart values with templates

Signed-off-by: spencercjh <spencercjh@gmail.com>
---
 Makefile                                      |  8 +-
 charts/ascend-device-plugin/README.md         | 43 +---------
 charts/ascend-device-plugin/README.md.gotmpl  | 22 +----
 .../ascend-device-plugin/values.schema.json   | 86 -------------------
 charts/ascend-device-plugin/values.yaml       | 54 +-----------
 5 files changed, 13 insertions(+), 200 deletions(-)

diff --git a/Makefile b/Makefile
index 163dde8..a567ef4 100644
--- a/Makefile
+++ b/Makefile
@@ -33,8 +33,12 @@ update-chart-docs:
 verify-helm-chart:
 	$(MAKE) update-chart-docs
 	git diff --exit-code -- charts/ascend-device-plugin/README.md charts/ascend-device-plugin/values.schema.json
-	helm lint charts/ascend-device-plugin
-	helm template ascend-device-plugin charts/ascend-device-plugin >/dev/null
+	@set -eu; \
+	manifest="$$(mktemp)"; \
+	trap 'rm -f "$$manifest"' EXIT; \
+	helm lint --strict charts/ascend-device-plugin; \
+	helm template ascend-device-plugin charts/ascend-device-plugin >"$$manifest"; \
+	awk '/^[[:space:]]+args:$$/ { in_args = 1; next } in_args && /^[[:space:]]*$$/ { next } in_args && /^[[:space:]]+- / { value = $$0; sub(/^[[:space:]]+- /, "", value); args[++count] = value; next } in_args { in_args = 0 } END { exit !(args[1] == "--config_file" && args[2] == "/device-config.yaml" && args[3] == "--node_config_file" && args[4] == "/node-config.yaml" && args[5] == "--v=4") }' "$$manifest"
 
 clean:
 	rm -rf ./ascend-device-plugin
diff --git a/charts/ascend-device-plugin/README.md b/charts/ascend-device-plugin/README.md
index 565ea51..d13e806 100644
--- a/charts/ascend-device-plugin/README.md
+++ b/charts/ascend-device-plugin/README.md
@@ -10,7 +10,6 @@ This chart deploys the standalone HAMi Ascend device plugin manifests:
 - ConfigMaps
 - RBAC and ServiceAccount
 - Device plugin DaemonSet
-- (Optional) vNPU monitor integration resources (Service, ServiceMonitor, PrometheusRule)
 
 ## Install
 
@@ -24,8 +23,7 @@ Install the chart:
 
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
-  --namespace kube-system \
-  --set image.tag=v1.3.0
+  --namespace kube-system
 ```
 
 If the HAMi chart already manages the Ascend device plugin DaemonSet, related ConfigMaps, RBAC, or RuntimeClass, do not deploy this standalone chart at the same time.
@@ -37,7 +35,6 @@ If another chart, such as the HAMi chart, already owns the shared `hami-schedule
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
   --namespace kube-system \
-  --set image.tag=v1.3.0 \
   --set config.create=false \
   --set config.existingDeviceConfigMapName=hami-scheduler-device
 ```
@@ -51,26 +48,9 @@ Enable the global `vnpus.hamiVnpuCore` switch in the generated device config:
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
   --namespace kube-system \
-  --set image.tag=v1.3.0 \
   --set hamiVnpuCore.enabled=true
 ```
 
-## vNPU Monitor Integration
-
-The chart can also create the resources from `ascend-vnpu-monitor-integration.yaml`.
-
-- `vnpuMonitor.enabled=true` creates the metrics `Service`.
-- `ServiceMonitor` and `PrometheusRule` are created by default; ensure Prometheus Operator CRDs are installed first.
-- You can disable either one with `vnpuMonitor.serviceMonitor.create=false` or `vnpuMonitor.prometheusRule.create=false`.
-
-```bash
-helm install ascend-device-plugin ./charts/ascend-device-plugin \
-  --namespace kube-system \
-  --set image.tag=v1.3.0 \
-  --set hamiVnpuCore.enabled=true \
-  --set vnpuMonitor.enabled=true
-```
-
 ## Node Configuration
 
 Override `nodeConfig` to enable or customize `hami-vnpu-core` per node:
@@ -92,7 +72,9 @@ nodeConfig: |-
 | config.existingDeviceConfigMapName | string | `""` | Existing device configuration ConfigMap to mount instead of the chart-managed ConfigMap. |
 | daemonSet.args[0] | string | `"--config_file"` |  |
 | daemonSet.args[1] | string | `"/device-config.yaml"` |  |
-| daemonSet.args[2] | string | `"--v=4"` |  |
+| daemonSet.args[2] | string | `"--node_config_file"` |  |
+| daemonSet.args[3] | string | `"/node-config.yaml"` |  |
+| daemonSet.args[4] | string | `"--v=4"` |  |
 | daemonSet.name | string | `"hami-ascend-device-plugin"` | Device plugin DaemonSet name. |
 | deviceConfig | string | `"vnpus:\n  hamiVnpuCore: {{ .Values.hamiVnpuCore.enabled }}\n  configs:\n  - chipName: 910A\n    commonWord: Ascend910A\n    resourceName: huawei.com/Ascend910A\n    resourceMemoryName: huawei.com/Ascend910A-memory\n    memoryAllocatable: 32768\n    memoryCapacity: 32768\n    aiCore: 30\n    templates:\n      - name: vir02\n        memory: 2184\n        aiCore: 2\n      - name: vir04\n        memory: 4369\n        aiCore: 4\n      - name: vir08\n        memory: 8738\n        aiCore: 8\n      - name: vir16\n        memory: 17476\n        aiCore: 16\n  - chipName: 910B2\n    commonWord: Ascend910B2\n    resourceName: huawei.com/Ascend910B2\n    resourceMemoryName: huawei.com/Ascend910B2-memory\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 24\n    aiCPU: 6\n    templates:\n      - name: vir03_1c_8g\n        memory: 8192\n        aiCore: 3\n        aiCPU: 1\n      - name: vir06_1c_16g\n        memory: 16384\n        aiCore: 6\n        aiCPU: 1\n      - name: vir12_3c_32g\n        memory: 32768\n        aiCore: 12\n        aiCPU: 3\n  - chipName: 910B3\n    commonWord: Ascend910B3\n    resourceName: huawei.com/Ascend910B3\n    resourceMemoryName: huawei.com/Ascend910B3-memory\n    resourceCoreName: huawei.com/Ascend910B3-core\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_16g\n        memory: 16384\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_32g\n        memory: 32768\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 910B4-1\n    commonWord: Ascend910B4-1\n    resourceName: huawei.com/Ascend910B4-1\n    resourceMemoryName: huawei.com/Ascend910B4-1-memory\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_16g\n        memory: 16384\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_32g\n        memory: 32768\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 910B4\n    commonWord: Ascend910B4\n    resourceName: huawei.com/Ascend910B4\n    resourceMemoryName: huawei.com/Ascend910B4-memory\n    memoryAllocatable: 32768\n    memoryCapacity: 32768\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_8g\n        memory: 8192\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_16g\n        memory: 16384\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 310P3\n    commonWord: Ascend310P\n    resourceName: huawei.com/Ascend310P\n    resourceMemoryName: huawei.com/Ascend310P-memory\n    memoryAllocatable: 21527\n    memoryCapacity: 24576\n    aiCore: 8\n    aiCPU: 7\n    templates:\n      - name: vir01\n        memory: 3072\n        aiCore: 1\n        aiCPU: 1\n      - name: vir02\n        memory: 6144\n        aiCore: 2\n        aiCPU: 2\n      - name: vir04\n        memory: 12288\n        aiCore: 4\n        aiCPU: 4\n  - chipName: Ascend910\n    commonWord: Ascend910C\n    resourceName: huawei.com/Ascend910C\n    resourceMemoryName: huawei.com/Ascend910C-memory\n    resourceCoreName: huawei.com/Ascend910C-core\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7"` |  |
 | fullnameOverride | string | `""` | Override the fully qualified resource name. |
@@ -115,20 +97,3 @@ nodeConfig: |-
 | runtimeClass.name | string | `"ascend"` | RuntimeClass resource name. |
 | serviceAccount.create | bool | `true` | Create a ServiceAccount for the device plugin. |
 | serviceAccount.name | string | `"hami-ascend"` | ServiceAccount name. Defaults to the chart fullname when empty and creation is enabled. |
-| vnpuMonitor.enabled | bool | `false` | Create vNPU monitoring integration resources. |
-| vnpuMonitor.prometheusRule.create | bool | `true` | Create a Prometheus Operator PrometheusRule. |
-| vnpuMonitor.prometheusRule.groupLabels.vendor | string | `"ascend"` | Vendor label applied to the Prometheus rule group. |
-| vnpuMonitor.prometheusRule.groupName | string | `"ascend-vnpu"` | Prometheus rule group name. |
-| vnpuMonitor.prometheusRule.interval | string | `"15s"` | Prometheus rule evaluation interval. |
-| vnpuMonitor.prometheusRule.labels.release | string | `"prometheus"` | Prometheus release label applied to the PrometheusRule. |
-| vnpuMonitor.prometheusRule.labels.role | string | `"recording-rules"` | Role label applied to the PrometheusRule. |
-| vnpuMonitor.prometheusRule.labels.vendor | string | `"ascend"` | Vendor label applied to the PrometheusRule. |
-| vnpuMonitor.prometheusRule.name | string | `"hami-ascend-vnpu-monitor"` | PrometheusRule name. |
-| vnpuMonitor.prometheusRule.namespace | string | `"monitoring"` | Namespace in which to create the PrometheusRule. |
-| vnpuMonitor.service.name | string | `"hami-ascend-device-plugin-metrics"` | Metrics Service name. |
-| vnpuMonitor.serviceMonitor.create | bool | `true` | Create a Prometheus Operator ServiceMonitor. |
-| vnpuMonitor.serviceMonitor.interval | string | `"15s"` | Metrics scrape interval. |
-| vnpuMonitor.serviceMonitor.labels.release | string | `"prometheus"` | Prometheus release label applied to the ServiceMonitor. |
-| vnpuMonitor.serviceMonitor.name | string | `"hami-ascend-vnpu-monitor"` | ServiceMonitor name. |
-| vnpuMonitor.serviceMonitor.namespace | string | `"monitoring"` | Namespace in which to create the ServiceMonitor. |
-| vnpuMonitor.serviceMonitor.path | string | `"/metrics"` | Metrics HTTP path. |
diff --git a/charts/ascend-device-plugin/README.md.gotmpl b/charts/ascend-device-plugin/README.md.gotmpl
index 0e46e8b..1cf9dae 100644
--- a/charts/ascend-device-plugin/README.md.gotmpl
+++ b/charts/ascend-device-plugin/README.md.gotmpl
@@ -10,7 +10,6 @@ This chart deploys the standalone HAMi Ascend device plugin manifests:
 - ConfigMaps
 - RBAC and ServiceAccount
 - Device plugin DaemonSet
-- (Optional) vNPU monitor integration resources (Service, ServiceMonitor, PrometheusRule)
 
 ## Install
 
@@ -24,8 +23,7 @@ Install the chart:
 
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
-  --namespace kube-system \
-  --set image.tag=v1.3.0
+  --namespace kube-system
 ```
 
 If the HAMi chart already manages the Ascend device plugin DaemonSet, related ConfigMaps, RBAC, or RuntimeClass, do not deploy this standalone chart at the same time.
@@ -37,7 +35,6 @@ If another chart, such as the HAMi chart, already owns the shared `hami-schedule
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
   --namespace kube-system \
-  --set image.tag=v1.3.0 \
   --set config.create=false \
   --set config.existingDeviceConfigMapName=hami-scheduler-device
 ```
@@ -51,26 +48,9 @@ Enable the global `vnpus.hamiVnpuCore` switch in the generated device config:
 ```bash
 helm install ascend-device-plugin ./charts/ascend-device-plugin \
   --namespace kube-system \
-  --set image.tag=v1.3.0 \
   --set hamiVnpuCore.enabled=true
 ```
 
-## vNPU Monitor Integration
-
-The chart can also create the resources from `ascend-vnpu-monitor-integration.yaml`.
-
-- `vnpuMonitor.enabled=true` creates the metrics `Service`.
-- `ServiceMonitor` and `PrometheusRule` are created by default; ensure Prometheus Operator CRDs are installed first.
-- You can disable either one with `vnpuMonitor.serviceMonitor.create=false` or `vnpuMonitor.prometheusRule.create=false`.
-
-```bash
-helm install ascend-device-plugin ./charts/ascend-device-plugin \
-  --namespace kube-system \
-  --set image.tag=v1.3.0 \
-  --set hamiVnpuCore.enabled=true \
-  --set vnpuMonitor.enabled=true
-```
-
 ## Node Configuration
 
 Override `nodeConfig` to enable or customize `hami-vnpu-core` per node:
diff --git a/charts/ascend-device-plugin/values.schema.json b/charts/ascend-device-plugin/values.schema.json
index 6de7e21..b210bae 100644
--- a/charts/ascend-device-plugin/values.schema.json
+++ b/charts/ascend-device-plugin/values.schema.json
@@ -142,92 +142,6 @@
                     "type": "string"
                 }
             }
-        },
-        "vnpuMonitor": {
-            "type": "object",
-            "properties": {
-                "enabled": {
-                    "type": "boolean"
-                },
-                "prometheusRule": {
-                    "type": "object",
-                    "properties": {
-                        "create": {
-                            "type": "boolean"
-                        },
-                        "groupLabels": {
-                            "type": "object",
-                            "properties": {
-                                "vendor": {
-                                    "type": "string"
-                                }
-                            }
-                        },
-                        "groupName": {
-                            "type": "string"
-                        },
-                        "interval": {
-                            "type": "string"
-                        },
-                        "labels": {
-                            "type": "object",
-                            "properties": {
-                                "release": {
-                                    "type": "string"
-                                },
-                                "role": {
-                                    "type": "string"
-                                },
-                                "vendor": {
-                                    "type": "string"
-                                }
-                            }
-                        },
-                        "name": {
-                            "type": "string"
-                        },
-                        "namespace": {
-                            "type": "string"
-                        }
-                    }
-                },
-                "service": {
-                    "type": "object",
-                    "properties": {
-                        "name": {
-                            "type": "string"
-                        }
-                    }
-                },
-                "serviceMonitor": {
-                    "type": "object",
-                    "properties": {
-                        "create": {
-                            "type": "boolean"
-                        },
-                        "interval": {
-                            "type": "string"
-                        },
-                        "labels": {
-                            "type": "object",
-                            "properties": {
-                                "release": {
-                                    "type": "string"
-                                }
-                            }
-                        },
-                        "name": {
-                            "type": "string"
-                        },
-                        "namespace": {
-                            "type": "string"
-                        },
-                        "path": {
-                            "type": "string"
-                        }
-                    }
-                }
-            }
         }
     }
 }
diff --git a/charts/ascend-device-plugin/values.yaml b/charts/ascend-device-plugin/values.yaml
index e7eb6e5..069182b 100644
--- a/charts/ascend-device-plugin/values.yaml
+++ b/charts/ascend-device-plugin/values.yaml
@@ -20,6 +20,8 @@ daemonSet:
   args:
     - --config_file
     - /device-config.yaml
+    - --node_config_file
+    - /node-config.yaml
     - --v=4
 
 rbac:
@@ -76,58 +78,6 @@ hamiVnpuCore:
   # hamiVnpuCore.enabled -- Enable hami-vnpu-core in the generated global device configuration.
   enabled: false
 
-vnpuMonitor:
-  # vnpuMonitor.enabled -- Create vNPU monitoring integration resources.
-  enabled: false
-  service:
-    # vnpuMonitor.service.name -- Metrics Service name.
-    name: hami-ascend-device-plugin-metrics
-  serviceMonitor:
-    # vnpuMonitor.serviceMonitor.create -- Create a Prometheus Operator ServiceMonitor.
-    create: true
-
-    # vnpuMonitor.serviceMonitor.name -- ServiceMonitor name.
-    name: hami-ascend-vnpu-monitor
-
-    # vnpuMonitor.serviceMonitor.namespace -- Namespace in which to create the ServiceMonitor.
-    namespace: monitoring
-    labels:
-      # vnpuMonitor.serviceMonitor.labels.release -- Prometheus release label applied to the ServiceMonitor.
-      release: prometheus
-
-    # vnpuMonitor.serviceMonitor.interval -- Metrics scrape interval.
-    interval: 15s
-
-    # vnpuMonitor.serviceMonitor.path -- Metrics HTTP path.
-    path: /metrics
-  prometheusRule:
-    # vnpuMonitor.prometheusRule.create -- Create a Prometheus Operator PrometheusRule.
-    create: true
-
-    # vnpuMonitor.prometheusRule.name -- PrometheusRule name.
-    name: hami-ascend-vnpu-monitor
-
-    # vnpuMonitor.prometheusRule.namespace -- Namespace in which to create the PrometheusRule.
-    namespace: monitoring
-    labels:
-      # vnpuMonitor.prometheusRule.labels.release -- Prometheus release label applied to the PrometheusRule.
-      release: prometheus
-
-      # vnpuMonitor.prometheusRule.labels.role -- Role label applied to the PrometheusRule.
-      role: recording-rules
-
-      # vnpuMonitor.prometheusRule.labels.vendor -- Vendor label applied to the PrometheusRule.
-      vendor: ascend
-
-    # vnpuMonitor.prometheusRule.groupName -- Prometheus rule group name.
-    groupName: ascend-vnpu
-
-    # vnpuMonitor.prometheusRule.interval -- Prometheus rule evaluation interval.
-    interval: 15s
-    groupLabels:
-      # vnpuMonitor.prometheusRule.groupLabels.vendor -- Vendor label applied to the Prometheus rule group.
-      vendor: ascend
-
  # @ignored
 deviceConfig: |-
   vnpus:

From 74a1769d787e40185ef8d9ed1c3d64f34f604265 Mon Sep 17 00:00:00 2001
From: spencercjh <spencercjh@gmail.com>
Date: Tue, 4 Aug 2026 05:36:20 +0000
Subject: [PATCH 8/9] fix(helm): harden chart release validation

Signed-off-by: spencercjh <spencercjh@gmail.com>
---
 .github/workflows/build-helm-release.yaml     | 31 ++++---
 .github/workflows/helm-lint.yaml              |  4 +-
 Makefile                                      | 25 +++++-
 charts/ascend-device-plugin/Chart.yaml        |  1 +
 charts/ascend-device-plugin/README.md         |  1 -
 .../ascend-device-plugin/values.schema.json   | 87 ++++++++++++++++---
 charts/ascend-device-plugin/values.yaml       | 62 ++++++-------
 docs/volcano.md                               |  2 +-
 docs/volcano_cn.md                            |  3 +-
 9 files changed, 156 insertions(+), 60 deletions(-)

diff --git a/.github/workflows/build-helm-release.yaml b/.github/workflows/build-helm-release.yaml
index bf4d667..68688c2 100644
--- a/.github/workflows/build-helm-release.yaml
+++ b/.github/workflows/build-helm-release.yaml
@@ -90,6 +90,26 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up Helm
+        uses: azure/setup-helm@v5.0.0
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Set up helm-docs
+        uses: gabe565/setup-helm-docs-action@v1
+        with:
+          version: v1.14.2
+
+      - name: Verify Helm chart before release writes
+        run: |
+          make verify-helm-chart
+          make verify-helm-release-path
+
       - name: Configure Git
         run: |
           git config user.name "$GITHUB_ACTOR"
@@ -120,22 +140,11 @@ jobs:
           git worktree remove --force "${workdir}"
           git fetch origin gh-pages
 
-      - name: Set up Helm
-        uses: azure/setup-helm@v5.0.0
-        with:
-          version: ${{ env.HELM_VERSION }}
-
-      - name: Package Helm chart
-        run: |
-          mkdir -p .cr-release-packages
-          helm package "${{ env.CHART_PATH }}" --destination .cr-release-packages
-
       - name: Run chart-releaser
         uses: helm/chart-releaser-action@v1.6.0
         with:
           charts_dir: charts
           skip_existing: true
-          skip_packaging: true
         env:
           CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/helm-lint.yaml b/.github/workflows/helm-lint.yaml
index cafac9c..2f93f99 100644
--- a/.github/workflows/helm-lint.yaml
+++ b/.github/workflows/helm-lint.yaml
@@ -59,7 +59,9 @@ jobs:
           version: v1.14.2
 
       - name: Run Helm chart verification
-        run: make verify-helm-chart
+        run: |
+          make verify-helm-chart
+          make verify-helm-release-path
 
   helm-lint-required:
     runs-on: ubuntu-latest
diff --git a/Makefile b/Makefile
index a567ef4..79a6cb2 100644
--- a/Makefile
+++ b/Makefile
@@ -38,9 +38,30 @@ verify-helm-chart:
 	trap 'rm -f "$$manifest"' EXIT; \
 	helm lint --strict charts/ascend-device-plugin; \
 	helm template ascend-device-plugin charts/ascend-device-plugin >"$$manifest"; \
-	awk '/^[[:space:]]+args:$$/ { in_args = 1; next } in_args && /^[[:space:]]*$$/ { next } in_args && /^[[:space:]]+- / { value = $$0; sub(/^[[:space:]]+- /, "", value); args[++count] = value; next } in_args { in_args = 0 } END { exit !(args[1] == "--config_file" && args[2] == "/device-config.yaml" && args[3] == "--node_config_file" && args[4] == "/node-config.yaml" && args[5] == "--v=4") }' "$$manifest"
+	awk '/^[[:space:]]+args:$$/ { in_args = 1; next } in_args && /^[[:space:]]*$$/ { next } in_args && /^[[:space:]]+- / { value = $$0; sub(/^[[:space:]]+- /, "", value); args[++count] = value; next } in_args { in_args = 0 } END { exit !(args[1] == "--config_file" && args[2] == "/device-config.yaml" && args[3] == "--node_config_file" && args[4] == "/node-config.yaml" && args[5] == "--v=4") }' "$$manifest"; \
+	if helm lint --strict charts/ascend-device-plugin --set image=null >/dev/null 2>&1; then echo 'null image value was accepted' >&2; exit 1; fi; \
+	if helm lint --strict charts/ascend-device-plugin --set daemonSet=null >/dev/null 2>&1; then echo 'null daemonSet value was accepted' >&2; exit 1; fi; \
+	if helm lint --strict charts/ascend-device-plugin --set image.repository= >/dev/null 2>&1; then echo 'empty image repository was accepted' >&2; exit 1; fi; \
+	if helm lint --strict charts/ascend-device-plugin --set image.pullPolicy=Sometimes >/dev/null 2>&1; then echo 'invalid image pull policy was accepted' >&2; exit 1; fi; \
+	if helm lint --strict charts/ascend-device-plugin --set image.unexpected=value >/dev/null 2>&1; then echo 'unknown image value was accepted' >&2; exit 1; fi; \
+	if helm template ascend-device-plugin charts/ascend-device-plugin --kube-version 1.19.16 >/dev/null 2>&1; then echo 'unsupported Kubernetes version was accepted' >&2; exit 1; fi
+
+.PHONY: verify-helm-release-path
+verify-helm-release-path:
+	@set -eu; \
+	packages="$$(mktemp -d)"; \
+	trap 'rm -rf "$$packages"' EXIT; \
+	chart_version="$$(awk '$$1 == "version:" { print $$2; exit }' charts/ascend-device-plugin/Chart.yaml)"; \
+	if [ -z "$$chart_version" ]; then echo 'failed to resolve chart version' >&2; exit 1; fi; \
+	helm package charts/ascend-device-plugin --destination "$$packages" >/dev/null; \
+	package_path="$$packages/ascend-device-plugin-$$chart_version.tgz"; \
+	test -f "$$package_path"; \
+	helm show chart "$$package_path" >/dev/null; \
+	grep -Fq 'uses: helm/chart-releaser-action@v1.6.0' .github/workflows/build-helm-release.yaml; \
+	grep -Fq 'charts_dir: charts' .github/workflows/build-helm-release.yaml; \
+	if grep -Eq '^[[:space:]]*skip_packaging:[[:space:]]*true' .github/workflows/build-helm-release.yaml; then echo 'chart-releaser skip_packaging must remain disabled' >&2; exit 1; fi
 
 clean:
 	rm -rf ./ascend-device-plugin
 
-.PHONY: all tidy test lint clean update-chart-docs verify-helm-chart
+.PHONY: all tidy test lint clean update-chart-docs verify-helm-chart verify-helm-release-path
diff --git a/charts/ascend-device-plugin/Chart.yaml b/charts/ascend-device-plugin/Chart.yaml
index ec1fe64..3676309 100644
--- a/charts/ascend-device-plugin/Chart.yaml
+++ b/charts/ascend-device-plugin/Chart.yaml
@@ -4,3 +4,4 @@ description: HAMi Ascend device plugin
 type: application
 version: 0.1.0
 appVersion: v1.4.0
+kubeVersion: ">=1.20.0-0"
diff --git a/charts/ascend-device-plugin/README.md b/charts/ascend-device-plugin/README.md
index d13e806..20978c0 100644
--- a/charts/ascend-device-plugin/README.md
+++ b/charts/ascend-device-plugin/README.md
@@ -76,7 +76,6 @@ nodeConfig: |-
 | daemonSet.args[3] | string | `"/node-config.yaml"` |  |
 | daemonSet.args[4] | string | `"--v=4"` |  |
 | daemonSet.name | string | `"hami-ascend-device-plugin"` | Device plugin DaemonSet name. |
-| deviceConfig | string | `"vnpus:\n  hamiVnpuCore: {{ .Values.hamiVnpuCore.enabled }}\n  configs:\n  - chipName: 910A\n    commonWord: Ascend910A\n    resourceName: huawei.com/Ascend910A\n    resourceMemoryName: huawei.com/Ascend910A-memory\n    memoryAllocatable: 32768\n    memoryCapacity: 32768\n    aiCore: 30\n    templates:\n      - name: vir02\n        memory: 2184\n        aiCore: 2\n      - name: vir04\n        memory: 4369\n        aiCore: 4\n      - name: vir08\n        memory: 8738\n        aiCore: 8\n      - name: vir16\n        memory: 17476\n        aiCore: 16\n  - chipName: 910B2\n    commonWord: Ascend910B2\n    resourceName: huawei.com/Ascend910B2\n    resourceMemoryName: huawei.com/Ascend910B2-memory\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 24\n    aiCPU: 6\n    templates:\n      - name: vir03_1c_8g\n        memory: 8192\n        aiCore: 3\n        aiCPU: 1\n      - name: vir06_1c_16g\n        memory: 16384\n        aiCore: 6\n        aiCPU: 1\n      - name: vir12_3c_32g\n        memory: 32768\n        aiCore: 12\n        aiCPU: 3\n  - chipName: 910B3\n    commonWord: Ascend910B3\n    resourceName: huawei.com/Ascend910B3\n    resourceMemoryName: huawei.com/Ascend910B3-memory\n    resourceCoreName: huawei.com/Ascend910B3-core\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_16g\n        memory: 16384\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_32g\n        memory: 32768\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 910B4-1\n    commonWord: Ascend910B4-1\n    resourceName: huawei.com/Ascend910B4-1\n    resourceMemoryName: huawei.com/Ascend910B4-1-memory\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_16g\n        memory: 16384\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_32g\n        memory: 32768\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 910B4\n    commonWord: Ascend910B4\n    resourceName: huawei.com/Ascend910B4\n    resourceMemoryName: huawei.com/Ascend910B4-memory\n    memoryAllocatable: 32768\n    memoryCapacity: 32768\n    aiCore: 20\n    aiCPU: 7\n    templates:\n      - name: vir05_1c_8g\n        memory: 8192\n        aiCore: 5\n        aiCPU: 1\n      - name: vir10_3c_16g\n        memory: 16384\n        aiCore: 10\n        aiCPU: 3\n  - chipName: 310P3\n    commonWord: Ascend310P\n    resourceName: huawei.com/Ascend310P\n    resourceMemoryName: huawei.com/Ascend310P-memory\n    memoryAllocatable: 21527\n    memoryCapacity: 24576\n    aiCore: 8\n    aiCPU: 7\n    templates:\n      - name: vir01\n        memory: 3072\n        aiCore: 1\n        aiCPU: 1\n      - name: vir02\n        memory: 6144\n        aiCore: 2\n        aiCPU: 2\n      - name: vir04\n        memory: 12288\n        aiCore: 4\n        aiCPU: 4\n  - chipName: Ascend910\n    commonWord: Ascend910C\n    resourceName: huawei.com/Ascend910C\n    resourceMemoryName: huawei.com/Ascend910C-memory\n    resourceCoreName: huawei.com/Ascend910C-core\n    memoryAllocatable: 65536\n    memoryCapacity: 65536\n    aiCore: 20\n    aiCPU: 7"` |  |
 | fullnameOverride | string | `""` | Override the fully qualified resource name. |
 | hamiVnpuCore.enabled | bool | `false` | Enable hami-vnpu-core in the generated global device configuration. |
 | image.pullPolicy | string | `"IfNotPresent"` | Kubernetes image pull policy. |
diff --git a/charts/ascend-device-plugin/values.schema.json b/charts/ascend-device-plugin/values.schema.json
index b210bae..2d706cc 100644
--- a/charts/ascend-device-plugin/values.schema.json
+++ b/charts/ascend-device-plugin/values.schema.json
@@ -1,9 +1,28 @@
 {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
     "type": "object",
+    "required": [
+        "image",
+        "daemonSet",
+        "rbac",
+        "runtimeClass",
+        "serviceAccount",
+        "nodeSelector",
+        "resources",
+        "config",
+        "nodeConfigMap",
+        "hamiVnpuCore",
+        "deviceConfig",
+        "nodeConfig"
+    ],
     "properties": {
         "config": {
             "type": "object",
+            "required": [
+                "create",
+                "existingDeviceConfigMapName",
+                "deviceConfigMapName"
+            ],
             "properties": {
                 "create": {
                     "type": "boolean"
@@ -14,10 +33,15 @@
                 "existingDeviceConfigMapName": {
                     "type": "string"
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "daemonSet": {
             "type": "object",
+            "required": [
+                "name",
+                "args"
+            ],
             "properties": {
                 "args": {
                     "type": "array",
@@ -28,7 +52,8 @@
                 "name": {
                     "type": "string"
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "deviceConfig": {
             "type": "string"
@@ -38,25 +63,40 @@
         },
         "hamiVnpuCore": {
             "type": "object",
+            "required": [
+                "enabled"
+            ],
             "properties": {
                 "enabled": {
                     "type": "boolean"
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "image": {
             "type": "object",
+            "required": [
+                "repository",
+                "pullPolicy"
+            ],
             "properties": {
                 "pullPolicy": {
-                    "type": "string"
+                    "type": "string",
+                    "enum": [
+                        "Always",
+                        "IfNotPresent",
+                        "Never"
+                    ]
                 },
                 "repository": {
-                    "type": "string"
+                    "type": "string",
+                    "minLength": 1
                 },
                 "tag": {
                     "type": "string"
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "nameOverride": {
             "type": "string"
@@ -66,6 +106,10 @@
         },
         "nodeConfigMap": {
             "type": "object",
+            "required": [
+                "create",
+                "name"
+            ],
             "properties": {
                 "create": {
                     "type": "boolean"
@@ -73,7 +117,8 @@
                 "name": {
                     "type": "string"
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "nodeSelector": {
             "type": "object",
@@ -85,14 +130,22 @@
         },
         "rbac": {
             "type": "object",
+            "required": [
+                "name"
+            ],
             "properties": {
                 "name": {
                     "type": "string"
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "resources": {
             "type": "object",
+            "required": [
+                "requests",
+                "limits"
+            ],
             "properties": {
                 "limits": {
                     "type": "object",
@@ -116,10 +169,16 @@
                         }
                     }
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "runtimeClass": {
             "type": "object",
+            "required": [
+                "create",
+                "name",
+                "handler"
+            ],
             "properties": {
                 "create": {
                     "type": "boolean"
@@ -130,10 +189,15 @@
                 "name": {
                     "type": "string"
                 }
-            }
+            },
+            "additionalProperties": false
         },
         "serviceAccount": {
             "type": "object",
+            "required": [
+                "create",
+                "name"
+            ],
             "properties": {
                 "create": {
                     "type": "boolean"
@@ -141,7 +205,8 @@
                 "name": {
                     "type": "string"
                 }
-            }
+            },
+            "additionalProperties": false
         }
     }
 }
diff --git a/charts/ascend-device-plugin/values.yaml b/charts/ascend-device-plugin/values.yaml
index 069182b..21642e3 100644
--- a/charts/ascend-device-plugin/values.yaml
+++ b/charts/ascend-device-plugin/values.yaml
@@ -1,12 +1,12 @@
-image:
+image: # @schema required:true;additionalProperties:false
   # image.repository -- Container image repository.
-  repository: projecthami/ascend-device-plugin
+  repository: projecthami/ascend-device-plugin # @schema required:true;minLength:1
 
   # image.tag -- Container image tag. Defaults to the chart `appVersion` when empty.
   tag: ""
 
   # image.pullPolicy -- Kubernetes image pull policy.
-  pullPolicy: IfNotPresent
+  pullPolicy: IfNotPresent # @schema required:true;enum:[Always, IfNotPresent, Never]
 
 # nameOverride -- Override the chart name used in resource names.
 nameOverride: ""
@@ -14,72 +14,72 @@ nameOverride: ""
 # fullnameOverride -- Override the fully qualified resource name.
 fullnameOverride: ""
 
-daemonSet:
+daemonSet: # @schema required:true;additionalProperties:false
   # daemonSet.name -- Device plugin DaemonSet name.
-  name: hami-ascend-device-plugin
-  args:
+  name: hami-ascend-device-plugin # @schema required:true
+  args: # @schema required:true
     - --config_file
     - /device-config.yaml
     - --node_config_file
     - /node-config.yaml
     - --v=4
 
-rbac:
+rbac: # @schema required:true;additionalProperties:false
   # rbac.name -- Name shared by the chart-managed RBAC resources.
-  name: hami-ascend
+  name: hami-ascend # @schema required:true
 
-runtimeClass:
+runtimeClass: # @schema required:true;additionalProperties:false
   # runtimeClass.create -- Create the Ascend RuntimeClass.
-  create: true
+  create: true # @schema required:true
 
   # runtimeClass.name -- RuntimeClass resource name.
-  name: ascend
+  name: ascend # @schema required:true
 
   # runtimeClass.handler -- Container runtime handler used by the RuntimeClass.
-  handler: ascend
+  handler: ascend # @schema required:true
 
-serviceAccount:
+serviceAccount: # @schema required:true;additionalProperties:false
   # serviceAccount.create -- Create a ServiceAccount for the device plugin.
-  create: true
+  create: true # @schema required:true
 
   # serviceAccount.name -- ServiceAccount name. Defaults to the chart fullname when empty and creation is enabled.
-  name: hami-ascend
+  name: hami-ascend # @schema required:true
 
-nodeSelector:
+nodeSelector: # @schema required:true
   # nodeSelector.ascend -- Node label value used to schedule the device plugin.
   ascend: "on"
 
-resources:
-  requests:
+resources: # @schema required:true;additionalProperties:false
+  requests: # @schema required:true
     memory: 500Mi
     cpu: 500m
-  limits:
+  limits: # @schema required:true
     memory: 500Mi
     cpu: 500m
 
-config:
+config: # @schema required:true;additionalProperties:false
   # config.create -- Create the device configuration ConfigMap.
-  create: true
+  create: true # @schema required:true
 
   # config.existingDeviceConfigMapName -- Existing device configuration ConfigMap to mount instead of the chart-managed ConfigMap.
-  existingDeviceConfigMapName: ""
+  existingDeviceConfigMapName: "" # @schema required:true
 
   # config.deviceConfigMapName -- Name of the chart-managed device configuration ConfigMap.
-  deviceConfigMapName: hami-scheduler-device
+  deviceConfigMapName: hami-scheduler-device # @schema required:true
 
-nodeConfigMap:
+nodeConfigMap: # @schema required:true;additionalProperties:false
   # nodeConfigMap.create -- Create the per-node configuration ConfigMap.
-  create: true
+  create: true # @schema required:true
 
   # nodeConfigMap.name -- Per-node configuration ConfigMap name.
-  name: hami-device-node-config
+  name: hami-device-node-config # @schema required:true
 
-hamiVnpuCore:
+hamiVnpuCore: # @schema required:true;additionalProperties:false
   # hamiVnpuCore.enabled -- Enable hami-vnpu-core in the generated global device configuration.
-  enabled: false
+  enabled: false # @schema required:true
 
- # @ignored
-deviceConfig: |-
+# @ignored
+deviceConfig: |- # @schema required:true
   vnpus:
     hamiVnpuCore: {{ .Values.hamiVnpuCore.enabled }}
     configs:
@@ -208,5 +208,5 @@ deviceConfig: |-
       aiCPU: 7
 
 # nodeConfig -- Per-node hami-vnpu-core configuration written to the node ConfigMap.
-nodeConfig: |-
+nodeConfig: |- # @schema required:true
   nodes: []
diff --git a/docs/volcano.md b/docs/volcano.md
index 73a2892..ced6d06 100644
--- a/docs/volcano.md
+++ b/docs/volcano.md
@@ -6,7 +6,7 @@ This guide covers deploying `ascend-device-plugin` for use with the [Volcano](ht
 
 ## Prerequisites
 
-- **Kubernetes**: ≥ 1.16
+- **Kubernetes**: ≥ 1.20
 - **Volcano**: ≥ 1.14 (≥ 1.16 required for `hami-core` soft slicing)
 - [ascend-docker-runtime](https://gitcode.com/Ascend/mind-cluster/tree/master/component/ascend-docker-runtime)
 - **Ascend Driver Version**: ≥ 25.5
diff --git a/docs/volcano_cn.md b/docs/volcano_cn.md
index 31c991d..8f601c8 100644
--- a/docs/volcano_cn.md
+++ b/docs/volcano_cn.md
@@ -6,7 +6,7 @@
 
 ## 环境要求
 
-- **Kubernetes**：≥ 1.16
+- **Kubernetes**：≥ 1.20
 - **Volcano**：≥ 1.14（`hami-core` 软切分需要 ≥ 1.16）
 - [ascend-docker-runtime](https://gitcode.com/Ascend/mind-cluster/tree/master/component/ascend-docker-runtime)
 - Ascend 驱动版本：≥ 25.5
@@ -165,4 +165,3 @@ curl -s $POD_IP:9395/metrics | grep hami_
 | `hami_vgpu_memory_used_bytes` | `namespace`, `pod`, `container`, `vdevice_index`, `device_uuid` | 每容器 vNPU 已用显存(字节) |
 | `hami_vgpu_memory_limit_bytes` | `namespace`, `pod`, `container`, `vdevice_index`, `device_uuid` | 每容器 vNPU 显存上限(字节) |
 | `hami_container_device_utilization_ratio` | `namespace`, `pod`, `container`, `vdevice_index`, `device_uuid` | 容器所在设备的 AICore 利用率(0–100) |
-

From 71adf6de4d3d548fd19683c578d453d85bacb7f0 Mon Sep 17 00:00:00 2001
From: spencercjh <spencercjh@gmail.com>
Date: Tue, 4 Aug 2026 05:46:49 +0000
Subject: [PATCH 9/9] fix(helm): package charts for GHCR fallback

Signed-off-by: spencercjh <spencercjh@gmail.com>
---
 .github/workflows/build-helm-release.yaml | 14 +++++++++++---
 Makefile                                  |  5 ++++-
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-helm-release.yaml b/.github/workflows/build-helm-release.yaml
index 68688c2..b3a8ce0 100644
--- a/.github/workflows/build-helm-release.yaml
+++ b/.github/workflows/build-helm-release.yaml
@@ -157,10 +157,9 @@ jobs:
 
           namespace="${GITHUB_REPOSITORY_OWNER,,}"
           chart_version="$(awk '$1 == "version:" { print $2; exit }' "${{ env.CHART_PATH }}/Chart.yaml")"
-          package_path=".cr-release-packages/${{ env.CHART_NAME }}-${chart_version}.tgz"
 
-          if [[ -z "${chart_version}" || ! -f "${package_path}" ]]; then
-            echo "failed to resolve packaged chart for ${{ env.CHART_NAME }}" >&2
+          if [[ -z "${chart_version}" ]]; then
+            echo "failed to resolve chart version for ${{ env.CHART_NAME }}" >&2
             exit 1
           fi
 
@@ -179,4 +178,13 @@ jobs:
             exit 1
           fi
 
+          mkdir -p .cr-release-packages
+          helm package "${{ env.CHART_PATH }}" --destination .cr-release-packages
+          package_path=".cr-release-packages/${{ env.CHART_NAME }}-${chart_version}.tgz"
+
+          if [[ ! -f "${package_path}" ]]; then
+            echo "failed to package chart for ${{ env.CHART_NAME }}" >&2
+            exit 1
+          fi
+
           helm push "${package_path}" "oci://ghcr.io/${namespace}/charts"
diff --git a/Makefile b/Makefile
index 79a6cb2..c7c7bbf 100644
--- a/Makefile
+++ b/Makefile
@@ -59,7 +59,10 @@ verify-helm-release-path:
 	helm show chart "$$package_path" >/dev/null; \
 	grep -Fq 'uses: helm/chart-releaser-action@v1.6.0' .github/workflows/build-helm-release.yaml; \
 	grep -Fq 'charts_dir: charts' .github/workflows/build-helm-release.yaml; \
-	if grep -Eq '^[[:space:]]*skip_packaging:[[:space:]]*true' .github/workflows/build-helm-release.yaml; then echo 'chart-releaser skip_packaging must remain disabled' >&2; exit 1; fi
+	if grep -Eq '^[[:space:]]*skip_packaging:[[:space:]]*true' .github/workflows/build-helm-release.yaml; then echo 'chart-releaser skip_packaging must remain disabled' >&2; exit 1; fi; \
+	show_line="$$(grep -n 'helm show chart' .github/workflows/build-helm-release.yaml | cut -d: -f1)"; \
+	package_line="$$(grep -n 'helm package "$${{ env.CHART_PATH }}" --destination .cr-release-packages' .github/workflows/build-helm-release.yaml | cut -d: -f1)"; \
+	if [ -z "$$show_line" ] || [ -z "$$package_line" ] || [ "$$show_line" -ge "$$package_line" ]; then echo 'GHCR existence check must precede packaging' >&2; exit 1; fi
 
 clean:
 	rm -rf ./ascend-device-plugin