ci: de-vendor helm/chart-releaser-action - #42506
Merged
Merged
Conversation
helm/chart-releaser-action is now allowlisted upstream (ASF Actions allowlist, apache/infrastructure-actions/actions.yml) at v1.7.0 (cae68fefc6b5f367a0275617c9f83181ba54714f), so the git-submodule fork under .github/actions/chart-releaser-action — added as a workaround when it wasn't allowlisted — is no longer needed. Verified with a real CI run (install_only, no release side effects) before landing this. Also drops the now-dead debug step that cat'd the vendored action's action.yml. helm/chart-testing-action stays vendored for now: it's allowlisted at v2.8.0 (6ec842c01de15ebb84c8627d2744a0c2f2755c9f), but that release depends internally on astral-sh/setup-uv@v7.0.0, which isn't itself on the allowlist (only v8.1.0+ are). De-vendoring it needs an INFRA request to add that setup-uv SHA first — confirmed by testing it directly, not just reading the config.
rusackas
requested review from
betodealmeida,
dpgaspar,
eschutho,
geido,
hainenber,
kgabryje,
mistercrunch,
nytai,
sadpandajoe,
sha174n and
villebro
as code owners
July 28, 2026 05:22
dosubot
Bot
added
deploy:helm
github_actions
Contributor
Code Review Agent Run #6c1726Actionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
sha174n
approved these changes
Jul 30, 2026
sha174n
left a comment
sha174n
left a comment
Contributor
There was a problem hiding this comment.
Approving — the action is pinned to a full commit SHA (cae68fe, v1.7.0), so the supply-chain surface is fine. LGTM.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
helm/chart-releaser-actionis now allowlisted upstream by ASF Infra (apache/infrastructure-actions/actions.yml) at v1.7.0 (cae68fefc6b5f367a0275617c9f83181ba54714f), so the git-submodule fork under.github/actions/chart-releaser-action— added as a workaround back when it wasn't allowlisted — is no longer needed.Also drops a now-dead debug step in
superset-helm-release.ymlthat justcat'd the vendored action'saction.yml.helm/chart-testing-actionintentionally NOT included here. It's also allowlisted (v2.8.0,6ec842c01de15ebb84c8627d2744a0c2f2755c9f), but that release depends internally onastral-sh/setup-uv@v7.0.0, which isn't itself on the allowlist (only v8.1.0+ currently are). Confirmed this directly rather than assuming — see TESTING INSTRUCTIONS. De-vendoring it needs an ASF Infra request to add that specificsetup-uvSHA (or forchart-testing-actionto cut a release pinning a currently-allowlistedsetup-uvversion) first. Left it on the vendored submodule with a comment explaining why.Also skipping
helm/kind-actionper discussion — installing/testing the chart in CI viakindis a separate, larger change than de-vendoring, and not something we're pursuing right now.FOLLOW-UP
Not filing an ASF Infra ticket for the missing
setup-uvSHA right now — helm chart support is being deprecated, so it's not worth spending Infra's time reviving an old allowlist entry for it. Worth revisiting if/when either of these lands:astral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c(v7.0.0) directly, orsetup-uvfrom 7.3.0 to 8.3.0 — currently allowlisted) merges and ships in a release, at which point that release's SHA just needs a normal Infra allowlist request.The repo is actively maintained (commits within the last week, 19 open issues, dependabot running), so no need to file anything new upstream — #218 already covers this.
TESTING INSTRUCTIONS
Validated directly against real CI on this branch before opening:
helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f(v1.7.0): ran successfully in an isolated diagnostic job (install_only: true, no release/publish side effects) — https://github.com/apache/superset/actions/runs/30331312381 (jobdiagnostic-chart-releaser-allowlist).helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f(v2.8.0): failed atSet up job— https://github.com/apache/superset/actions/runs/30331090959 — annotation confirmsastral-sh/setup-uv@eb1897b8dc4b5d5bfe39a428a8f2304605e0983c(v7.0.0) is not allowlisted. This is why it's staying vendored for now.superset-helm-release.ymlrelease job itself was not run end-to-end (it force-pushes branches and opens a real PR togh-pages— too disruptive to trigger just for validation); thechart-releaser-actionswap is validated via the isolatedinstall_onlyjob instead, which exercises the same allowlist gate without the side effects.ADDITIONAL INFORMATION