release charts as OCI artifacts on the native runners

Chart publishing ran on a hosted runner and pushed to a pages branch, which
is neither where this org builds nor where anything else it ships is fetched
from. It now runs on lux-build-linux-amd64 and pushes to ghcr.io/luxfi/charts,
so a chart comes from the same registry as the images it deploys.

Every chart is linted and rendered against each of its values files before
anything is pushed.

.github/workflows/release.yaml

@@ -1,41 +0,0 @@
-name: Release Charts
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git
-        run: |
-          git config user.name "$GITHUB_ACTOR"
-          git config user.email "[email protected]"
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-        with:
-          version: v3.14.0
-
-      - name: Add dependency repos
-        run: |
-          helm repo add bitnami https://charts.bitnami.com/bitnami
-          helm repo add hanzoai https://hanzoai.github.io/charts/
-          helm repo update
-
-      - name: Run chart-releaser
-        uses: helm/[email protected]
-        with:
-          charts_dir: charts
-        env:
-          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.hanzo/workflows/release.yaml

@@ -0,0 +1,58 @@
+name: Release
+
+# Publishes each chart as an OCI artifact to ghcr.io/luxfi/charts on the native
+# runners. A chart installs straight from the registry that already serves the
+# images it deploys, so there is one place to fetch from and no pages branch to
+# keep in step.
+#
+# ghcr auth: GHCR_USER / GHCR_TOKEN — org Actions secrets on this forge.
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: [lux-build-linux-amd64]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install helm
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 \
+            | HELM_INSTALL_DIR=/usr/local/bin bash
+          helm version --short
+
+      - name: Lint every chart
+        run: |
+          for c in charts/*/; do
+            echo "== lint $c"
+            helm lint "$c"
+          done
+
+      - name: Render every chart against each values file
+        run: |
+          for c in charts/*/; do
+            for v in "$c"values-*.yaml; do
+              [ -e "$v" ] || continue
+              echo "== template $c with $(basename "$v")"
+              helm template check "$c" -f "$v" > /dev/null
+            done
+          done
+
+      - name: Log in to ghcr
+        run: |
+          echo "${{ secrets.GHCR_TOKEN }}" \
+            | helm registry login ghcr.io -u "${{ secrets.GHCR_USER }}" --password-stdin
+
+      - name: Package and push
+        run: |
+          mkdir -p dist
+          for c in charts/*/; do
+            helm package "$c" -d dist
+          done
+          for pkg in dist/*.tgz; do
+            echo "== push $pkg"
+            helm push "$pkg" oci://ghcr.io/luxfi/charts
+          done

ct.yaml

@@ -1 +0,0 @@
-target-branch: main