ci(helm): add chart release workflows

.github/workflows/build-helm-release.yaml

@@ -0,0 +1,190 @@
+name: Helm Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+    paths:
+      - charts/ascend-device-plugin/Chart.yaml
+
+env:
+  HELM_VERSION: "v3.20.0"
+  CHART_PATH: charts/ascend-device-plugin
+  CHART_NAME: ascend-device-plugin
+
+permissions:
+  contents: read
+
+concurrency:
+  group: helm-release
+  cancel-in-progress: false
+
+jobs:
+  detect-chart-version:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    outputs:
+      version_changed: ${{ steps.compare.outputs.version_changed }}
+      previous_version: ${{ steps.compare.outputs.previous_version }}
+      current_version: ${{ steps.compare.outputs.current_version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Compare chart version
+        id: compare
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          before_sha="${{ github.event.before }}"
+          if [[ -z "${before_sha}" || "${before_sha}" == "0000000000000000000000000000000000000000" ]]; then
+            echo "github.event.before is not available for this push" >&2
+            exit 1
+          fi
+
+          current_version="$(awk '$1 == "version:" { print $2; exit }' "${{ env.CHART_PATH }}/Chart.yaml")"
+          if [[ -z "${current_version}" ]]; then
+            echo "failed to resolve current chart version from ${{ env.CHART_PATH }}/Chart.yaml" >&2
+            exit 1
+          fi
+
+          if git cat-file -e "${before_sha}:${{ env.CHART_PATH }}/Chart.yaml" 2>/dev/null; then
+            previous_version="$(git show "${before_sha}:${{ env.CHART_PATH }}/Chart.yaml" | awk '$1 == "version:" { print $2; exit }')"
+          else
+            previous_version=""
+          fi
+
+          if [[ -z "${previous_version}" || "${previous_version}" != "${current_version}" ]]; then
+            version_changed=true
+          else
+            version_changed=false
+          fi
+
+          {
+            echo "previous_version=${previous_version}"
+            echo "current_version=${current_version}"
+            echo "version_changed=${version_changed}"
+          } >>"$GITHUB_OUTPUT"
+
+  helm-release:
+    needs:
+      - detect-chart-version
+    if: >-
+      always() &&
+      (github.event_name == 'workflow_dispatch' ||
+      startsWith(github.ref, 'refs/tags/') ||
+      needs.detect-chart-version.outputs.version_changed == 'true')
+    permissions:
+      contents: write
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5.0.0
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Set up helm-docs
+        uses: gabe565/setup-helm-docs-action@v1
+        with:
+          version: v1.14.2
+
+      - name: Verify Helm chart before release writes
+        run: |
+          make verify-helm-chart
+          make verify-helm-release-path
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Ensure gh-pages branch exists
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if git ls-remote --exit-code --heads origin gh-pages >/dev/null 2>&1; then
+            echo "origin/gh-pages already exists"
+            exit 0
+          fi
+
+          workdir="$(mktemp -d)"
+          git worktree add --detach "${workdir}" HEAD
+
+          pushd "${workdir}"
+          git switch --orphan gh-pages
+          git rm -rf . >/dev/null 2>&1 || true
+          touch .nojekyll
+          git add .nojekyll
+          git commit -m "chore: initialize gh-pages branch"
+          git push origin gh-pages
+          popd
+
+          git worktree remove --force "${workdir}"
+          git fetch origin gh-pages
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.6.0
+        with:
+          charts_dir: charts
+          skip_existing: true
+        env:
+          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish Helm chart to GHCR
+        shell: bash
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          namespace="${GITHUB_REPOSITORY_OWNER,,}"
+          chart_version="$(awk '$1 == "version:" { print $2; exit }' "${{ env.CHART_PATH }}/Chart.yaml")"
+
+          if [[ -z "${chart_version}" ]]; then
+            echo "failed to resolve chart version for ${{ env.CHART_NAME }}" >&2
+            exit 1
+          fi
+
+          echo "${GHCR_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
+          chart_ref="oci://ghcr.io/${namespace}/charts/${{ env.CHART_NAME }}"
+          lookup_error="$(mktemp)"
+
+          if helm show chart "${chart_ref}" --version "${chart_version}" >/dev/null 2>"${lookup_error}"; then
+            echo "${chart_ref}:${chart_version} already exists; skipping GHCR push"
+            exit 0
+          fi
+
+          if ! grep -Eqi 'not found|manifest unknown' "${lookup_error}"; then
+            echo "failed to query ${chart_ref}:${chart_version}" >&2
+            cat "${lookup_error}" >&2
+            exit 1
+          fi
+
+          mkdir -p .cr-release-packages
+          helm package "${{ env.CHART_PATH }}" --destination .cr-release-packages
+          package_path=".cr-release-packages/${{ env.CHART_NAME }}-${chart_version}.tgz"
+
+          if [[ ! -f "${package_path}" ]]; then
+            echo "failed to package chart for ${{ env.CHART_NAME }}" >&2
+            exit 1
+          fi
+
+          helm push "${package_path}" "oci://ghcr.io/${namespace}/charts"

.github/workflows/helm-lint.yaml

@@ -0,0 +1,89 @@
+name: Helm Lint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+env:
+  HELM_VERSION: "v3.20.0"
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      helm: ${{ steps.filter.outputs.helm }}
+    steps:
+      - name: Detect Helm changes
+        uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            helm:
+              - 'charts/ascend-device-plugin/**'
+              - 'Makefile'
+              - '.github/workflows/helm-lint.yaml'
+              - '.github/workflows/build-helm-release.yaml'
+
+  lint-test:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.helm == 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5.0.0
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Set up helm-docs
+        uses: gabe565/setup-helm-docs-action@v1
+        with:
+          version: v1.14.2
+
+      - name: Run Helm chart verification
+        run: |
+          make verify-helm-chart
+          make verify-helm-release-path
+
+  helm-lint-required:
+    runs-on: ubuntu-latest
+    needs:
+      - changes
+      - lint-test
+    if: always()
+    steps:
+      - name: Check Helm workflow result
+        shell: bash
+        run: |
+          if [[ "${{ needs.changes.result }}" != "success" ]]; then
+            echo "Helm change detection did not complete successfully: ${{ needs.changes.result }}"
+            exit 1
+          fi
+
+          if [[ "${{ needs.changes.outputs.helm }}" != "true" ]]; then
+            echo "No Helm-relevant changes."
+            exit 0
+          fi
+
+          if [[ "${{ needs.lint-test.result }}" != "success" ]]; then
+            echo "Helm verification did not complete successfully: ${{ needs.lint-test.result }}"
+            exit 1
+          fi

.gitignore

@@ -0,0 +1,75 @@
+### Linux template
+*~
+
+# temporary files which can be created if a process still has a handle open of a deleted file
+.fuse_hidden*
+
+# KDE directory preferences
+.directory
+
+# Linux trash folder which might appear on any partition or disk
+.Trash-*
+
+# .nfs files are created when an open file is removed but is still being accessed
+.nfs*
+
+### Go template
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# env file
+.env
+
+### macOS template
+# General
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# Icon must end with two \r
+Icon
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+
+### Custom
+.idea/
+.vscode/
+.worktree/