azure/setup-helm

Install a specific version of the Helm CLI on the runner.

Official actionCategory: Infrastructure & KubernetesLatest v5View on GitHub

What it does

azure/setup-helm installs the requested Helm version so later steps can run helm install/upgrade, package charts, or push to chart registries.

Like setup-kubectl it only installs the tool; cluster access still comes from your cloud login and kubeconfig steps.

Usage

workflow (.yml)

steps:
  - uses: actions/checkout@v4
  - uses: azure/setup-helm@v5
    with:
      version: v3.16.4
  - run: helm upgrade --install my-app ./charts/my-app --namespace my-app

Inputs

Input	Description	Default	Required
`version`	Version of helm (latest or a semantic version).	`latest`	No
`version-file`	Path to a .tool-versions file to read the helm version from.	-	No
`downloadBaseURL`	Set the download base URL.	`https://get.helm.sh`	No

Outputs

Output	Description
`helm-path`	Path to the cached helm binary.

Notes

The token input is deprecated, a GitHub token is no longer required to resolve the latest version.

version-file lets a .tool-versions file be the single source of truth for the Helm version across local dev and CI.

Binaries download from get.helm.sh by default; downloadBaseURL supports mirroring for restricted networks.

Common errors

A download failure for an invalid version string, use latest or an exact release version.
Kubernetes cluster unreachable from helm means kubeconfig/cluster credentials are missing, not that the install failed.

Security and pinning

Pin the action to a commit SHA and pin version, a floating Helm version can change deploy behavior between runs.

Alternatives and related

azure/setup-kubectlInstall a specific version of kubectl on the runner. azure/loginLog in to Azure in a workflow, using OIDC federated credentials or a service principal. google-github-actions/authAuthenticate to Google Cloud, ideally via keyless Workload Identity Federation.

Frequently asked questions

Do I still need to pass a GitHub token to setup-helm?

No. The token input is deprecated and no longer required, even for resolving latest.