.github

Charts image releases

.github/workflows/bump-charts.yml updates a component's image tag through the Charts repository's existing bump-image repository dispatch workflow. Call it after publishing the image, and pin the reusable workflow to a full commit SHA:

jobs:
  bump-charts:
    needs: docker
    if: startsWith(github.ref, 'refs/tags/v')
    uses: widgetbot-io/.github/.github/workflows/bump-charts.yml@<FULL_COMMIT_SHA>
    permissions: {}
    with:
      component: bot
      tag: ${{ github.ref_name }}
      strip-tag-prefix: v
    secrets:
      CHARTS_APP_ID: ${{ secrets.CHARTS_APP_ID }}
      CHARTS_APP_PRIVATE_KEY: ${{ secrets.CHARTS_APP_PRIVATE_KEY }}

component and tag are required strings. Supported components are bot, embed, gateway, server, server-v3, telegram-gateway, whatsapp-gateway, slack-gateway, premium, statistics, arbuckle, and garfield. strip-tag-prefix defaults to an empty string and removes an exact, literal prefix only when present. For example, v1.2.3 becomes 1.2.3 with prefix v; omit the input when the published image tag includes v. The resulting tag must follow Docker's tag format and be at most 128 characters.

Create a dedicated Charts release GitHub App with repository Contents: read and write, and install it on only widgetbot-io/Charts. Store its numeric App ID and private key as CHARTS_APP_ID and CHARTS_APP_PRIVATE_KEY organization Actions secrets. Use the selected repositories visibility to grant those secrets only to participating caller repositories, and pass both explicitly as shown above. Secrets in this shared repository are not automatically available to callers.

Each job creates a short-lived installation token restricted to Charts with contents:write; the token action revokes it when the job finishes. The workflow does not need a checkout or any GITHUB_TOKEN permissions. Keep existing PATs used by other jobs, including any remaining GHCR authentication. Registry jobs that already use GITHUB_TOKEN should continue using it.

Deploying a gitops app (and verifying it)

.github/workflows/deploy-gitops-app.yml is for apps under Charts/gitops-apps/<cluster>/<app>/ (busybody first). It pins a new image tag in the app's values.yaml, commits deploy: <app> to <tag> to Charts master, has ArgoCD sync exactly that commit, and fails the job unless the deploy landed: operation Succeeded, Synced and Healthy at the bump commit, every Deployment on the new tag, the migrate hook (if any) Succeeded, and no partial sync. It runs on the in-cluster widgetbot-io runners and drives Argo with kubectl through the runner ServiceAccount, so no Argo token is involved.

The header comment of the workflow says how to opt an app in: the caller job, the secrets (CHARTS_APP_ID / CHARTS_APP_PRIVATE_KEY, granted to the app's repo), and what Charts needs (the pinned image and the app listed under ciDeployer.apps in gitops-apps/widgetbot-internal/arc-runners/values.yaml).