Call Release Helm Charts workflow (Project-HAMi/HAMi)
The Call Release Helm Charts workflow from Project-HAMi/HAMi, explained and optimized by Latchkey.
CI health: B - good
Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Call Release Helm Charts workflow from the Project-HAMi/HAMi repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
name: Call Release Helm Charts
# must set branch 'github_pages' as github page
# this workflow will create the tgz from "/charts/*" of branch main,
# and deploy to "/charts" of branch "github_pages"
# and on branch "github_pages", update '/index.yaml' for '/charts/*.tgz'
env:
HELM_VERSION: v3.8.1
MERGE_BRANCH: gh-pages
on:
workflow_call:
inputs:
ref:
required: true
type: string
submit:
required: true
type: string
outputs:
artifact:
description: "name of artifact"
value: chart_package_artifact
workflow_dispatch:
inputs:
ref:
description: 'tag, sha, branch'
required: true
default: v1.0.0
permissions: write-all
jobs:
get_ref:
runs-on: ubuntu-latest
outputs:
ref: ${{ env.REF }}
submit: ${{ env.SUBMIT }}
steps:
- name: Get Original Ref
id: get_original_ref
run: |
if ${{ inputs.ref != '' }} ; then
echo "call by workflow_call"
echo "REF=${{ inputs.ref }}" >> $GITHUB_ENV
echo "SUBMIT=${{ inputs.submit }}" >> $GITHUB_ENV
elif ${{ github.event_name == 'workflow_dispatch' }} ; then
echo "call by self workflow_dispatch"
echo "REF=${{ inputs.ref }}" >> $GITHUB_ENV
echo "SUBMIT=true" >> $GITHUB_ENV
else
echo "unexpected event: ${{ github.event_name }}"
exit 1
fi
# packages tgz from /charts of original branch, deploy to /charts of target branch
package_chart:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
ref: ${{ needs.get_ref.outputs.ref }}
- name: Configure Git
run: |
git config user.name "$GITHUB_ACTOR"
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
- name: Install Helm
uses: azure/setup-helm@v5
with:
version: ${{ env.HELM_VERSION }}
- name: Add HAMi DRA Helm repository
run: |
helm repo add hami-dra https://project-hami.github.io/HAMi-DRA/
helm repo update hami-dra
- name: Lint helm chart
run: |
make lint_chart
- name: Package Chart
continue-on-error: false
run: |
cd charts
make clean
make
if ! ls *.tgz &>/dev/null ; then
echo "failed to generate chart"
exit 1
fi
cd ..
mkdir -p tmp
mv charts/*.tgz tmp
- name: Upload Artifact
uses: actions/upload-artifact@v7
with:
name: chart_package_artifact
path: tmp/*
retention-days: 1
if-no-files-found: error
# update /index.yaml in the target branch
update_githubpage:
runs-on: ubuntu-latest
needs: [package_chart, get_ref]
if: ${{ needs.get_ref.outputs.submit == 'true' }}
steps:
- name: Get Base Chart URL
id: get_base_url
run: |
name=${{ github.repository }}
proj=${name#*/}
url=https://${{ github.repository_owner }}.github.io/${proj}
echo "URL=${url}" >> $GITHUB_ENV
- name: Checkout Code
uses: actions/checkout@v7
with:
ref: ${{ env.MERGE_BRANCH }}
persist-credentials: "true"
- name: Download Artifact
uses: actions/download-artifact@v8
with:
name: chart_package_artifact
path: charts/
- name: Update Chart Yaml
run: |
helm repo index ./charts --url ${{ env.URL }}/charts
mv ./charts/index.yaml ./index.yaml
- name: update helm release
id: push_directory
uses: cpina/github-action-push-to-another-repository@v1.7.3
env:
API_TOKEN_GITHUB: ${{ secrets.API_TOKEN_GITHUB }}
with:
source-directory: .
destination-github-username: ${{ github.repository_owner }}
destination-repository-name: hami
user-email: xiaozhang0210@hotmail.com
commit-message: sync ORIGIN_COMMIT from $GITHUB_REF
target-branch: ${{ env.MERGE_BRANCH }}
The same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
name: Call Release Helm Charts # must set branch 'github_pages' as github page # this workflow will create the tgz from "/charts/*" of branch main, # and deploy to "/charts" of branch "github_pages" # and on branch "github_pages", update '/index.yaml' for '/charts/*.tgz' env: HELM_VERSION: v3.8.1 MERGE_BRANCH: gh-pages on: workflow_call: inputs: ref: required: true type: string submit: required: true type: string outputs: artifact: description: "name of artifact" value: chart_package_artifact workflow_dispatch: inputs: ref: description: 'tag, sha, branch' required: true default: v1.0.0 permissions: write-all jobs: get_ref: timeout-minutes: 30 runs-on: latchkey-small outputs: ref: ${{ env.REF }} submit: ${{ env.SUBMIT }} steps: - name: Get Original Ref id: get_original_ref run: | if ${{ inputs.ref != '' }} ; then echo "call by workflow_call" echo "REF=${{ inputs.ref }}" >> $GITHUB_ENV echo "SUBMIT=${{ inputs.submit }}" >> $GITHUB_ENV elif ${{ github.event_name == 'workflow_dispatch' }} ; then echo "call by self workflow_dispatch" echo "REF=${{ inputs.ref }}" >> $GITHUB_ENV echo "SUBMIT=true" >> $GITHUB_ENV else echo "unexpected event: ${{ github.event_name }}" exit 1 fi # packages tgz from /charts of original branch, deploy to /charts of target branch package_chart: timeout-minutes: 30 runs-on: latchkey-small steps: - name: Checkout uses: actions/checkout@v7 with: fetch-depth: 0 ref: ${{ needs.get_ref.outputs.ref }} - name: Configure Git run: | git config user.name "$GITHUB_ACTOR" git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Install Helm uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} - name: Add HAMi DRA Helm repository run: | helm repo add hami-dra https://project-hami.github.io/HAMi-DRA/ helm repo update hami-dra - name: Lint helm chart run: | make lint_chart - name: Package Chart continue-on-error: false run: | cd charts make clean make if ! ls *.tgz &>/dev/null ; then echo "failed to generate chart" exit 1 fi cd .. mkdir -p tmp mv charts/*.tgz tmp - name: Upload Artifact uses: actions/upload-artifact@v7 with: name: chart_package_artifact path: tmp/* retention-days: 1 if-no-files-found: error # update /index.yaml in the target branch update_githubpage: timeout-minutes: 30 runs-on: latchkey-small needs: [package_chart, get_ref] if: ${{ needs.get_ref.outputs.submit == 'true' }} steps: - name: Get Base Chart URL id: get_base_url run: | name=${{ github.repository }} proj=${name#*/} url=https://${{ github.repository_owner }}.github.io/${proj} echo "URL=${url}" >> $GITHUB_ENV - name: Checkout Code uses: actions/checkout@v7 with: ref: ${{ env.MERGE_BRANCH }} persist-credentials: "true" - name: Download Artifact uses: actions/download-artifact@v8 with: name: chart_package_artifact path: charts/ - name: Update Chart Yaml run: | helm repo index ./charts --url ${{ env.URL }}/charts mv ./charts/index.yaml ./index.yaml - name: update helm release id: push_directory uses: cpina/github-action-push-to-another-repository@v1.7.3 env: API_TOKEN_GITHUB: ${{ secrets.API_TOKEN_GITHUB }} with: source-directory: . destination-github-username: ${{ github.repository_owner }} destination-repository-name: hami user-email: xiaozhang0210@hotmail.com commit-message: sync ORIGIN_COMMIT from $GITHUB_REF target-branch: ${{ env.MERGE_BRANCH }}
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Add a job timeout so a hung step cannot burn hours of runner time.
2 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.
This workflow runs 3 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.