feat(release): ArtifactHub publish 파이프라인 부활 — GHA 2-workflow narrow exception + signed OCI (ADR-0019) - #81
Merged
Conversation
…xception + signed OCI (ADR-0019)
원안 feat/artifacthub-publish-pipeline (2026-06-02) 의 신 사실 기준 재작성 부활.
사용자 거버넌스 결정 (2026-06-12) — RFC-0002 GHA 예외 인정 (postgres ADR-0022 선례).
[변경]
- .github/workflows/helm-publish.yml: GPG 서명 chart → oci://ghcr.io/keiailab/charts/keiailab-commons
(release/tag/dispatch 트리거, OCI 멱등 skip). gh-pages 단계 의도적 생략 (소비 경로 OCI 뿐).
- .github/workflows/artifacthub-verify.yml: ah lint (PR) + 등록·인덱싱·signed smoke (tag/dispatch).
- hack/artifacthub_{smoke,register}.sh: mongodb-operator 현행 본 (2026-06-10) 이식.
- charts/artifacthub-repo.yml: 회전 서명키 F1A68935... + repositoryID placeholder.
- charts/keiailab-helm-signing-public.asc + Chart.yaml artifacthub.io/signKey annotation.
- docs/kb/adr/0019 + INDEX 4벌 (en/ko/ja/zh).
[원안 대비 정정]
- 서명키 89A40947(구) → F1A68935(2026-06-10 회전본, 3 operator 와 동일)
- operator-commons/Apache-2.0 표기 → keiailab-commons/MIT
- gh-pages HTTP 추적 → OCI 추적 (3 operator 실 등록 실측 정합)
- ADR-0018 번호 선점 → 0019 채번
[검증]
- helm package --sign + helm verify 로컬 PASS (fingerprint F1A68935..., .prov 생성)
- actionlint PASS / helm lint 0 failed / bash -n PASS / artifacthub-repo.yml yaml parse OK
- repo secret HELM_SIGNING_PRIVATE_KEY 설정 완료 (passphrase 없음 — mongodb 구성 정합)
PLAN_BYPASS=1 사유: gha-block hook 의 예외 ADR 의무 — ADR-0019 본 커밋 동봉.
후속: AH 등록 (AH_API_KEY_ID/SECRET secret — mongodb 와 동일 값 필요) → repositoryID 기입 → OCI metadata push.
Refs: ADR-0019, ADR-0022(postgres), ADR-0037(mongodb), RFC-0002
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
feat/artifacthub-publish-pipeline(2026-06-02 원안, triage keep 판정) 의 신 사실 기준 재작성 부활 — 사용자 거버넌스 결정 (2026-06-12): RFC-0002 GHA 예외 인정 (postgres-operator ADR-0022 선례).4 repo 파이프라인 점검 실측: 3 operator 는 ArtifactHub OCI 등록 + verified publisher 완료, commons 만 미등록 + GHA publish 부재 (수동 release.sh 의존 = ArtifactHub stale 구조 원인).
변경 (12 files, +636)
oci://ghcr.io/keiailab/charts/keiailab-commons(release/tag/dispatch, OCI 멱등 skip). tag↔chart parity 부적용 (Go semver ≠ chart version, ADR-0019) + gh-pages 단계 의도적 생략 (소비 경로 OCI 뿐).F1A68935...+ repositoryID placeholder.artifacthub.io/signKeyannotation.원안 대비 정정
검증 (로컬 게이트 PASS)
helm package --sign+helm verify로컬 PASS — fingerprintF1A6893583E632A757FF6767F3CC8C6AEC9CEB08,.prov생성, Chart Hash VerifiedHELM_SIGNING_PRIVATE_KEY설정 완료 (passphrase 없음 — mongodb 구성 정합)PLAN_BYPASS 사유
gha-block lefthook (ADR-0012) 우회 — 예외 ADR 의무를 ADR-0019 동봉으로 충족.
후속 (머지 후)
AH_API_KEY_ID/AH_API_KEY_SECRETrepo secret (mongodb-operator 와 동일 값) →hack/artifacthub_register.sh등록charts/artifacthub-repo.ymlrepositoryID 기입:artifacthub.io태그) → verified publisher