chart-releaser-action

chart-releaser Action

A GitHub action to turn a GitHub project into a self-hosted Helm chart repo, using helm/chart-releaser CLI tool.

Usage

Pre-requisites

1. A GitHub repo containing a directory with your Helm charts (default is a folder named /charts, if you want to maintain your charts in a different directory, you must include a charts_dir input in the workflow).
2. A GitHub branch to store the index and, optionally, chart packages. If the configured pages_branch (default: gh-pages) does not exist, the action creates it as an empty branch before publishing. The workflow needs contents: write permission.
3. In your repo, go to Settings/Pages. Change the Source Branch to the configured publishing branch (default: gh-pages).
4. Create a workflow .yml file in your .github/workflows directory. An example workflow is available below. For more information, reference the GitHub Help Documentation for Creating a workflow file

Publishing branch setup

The action creates a missing publishing branch as an empty branch, separate from the source branch, so it does not inherit source files, workflows, or .gitignore rules. This happens only when charts are published; it does not create the branch when there are no chart changes or when index uploads are skipped. If you configure pages_branch in the action or pages-branch in the chart-releaser config, that branch is initialized instead of gh-pages.

When packages_with_index: true is enabled, the action commits .tgz chart packages alongside index.yaml. The publishing branch's .gitignore must allow those files. In particular, remove an inherited *.tgz rule if Git reports The following paths are ignored by one of your .gitignore files. You can still ignore .tgz files on the source branch; its ignore rules do not apply to a separate publishing branch.

Checkout credentials

Chart-releaser uses Git worktrees to publish the index and chart packages. If you use actions/checkout@v6, use v6.0.1 or later: v6.0.0 moved persisted credentials to a separate file without making them available in worktrees. This was fixed in actions/checkout#2327. The example below uses v7, which includes the fix.

If publishing fails with fatal: could not read Username for 'https://github.com': No such device or address, check the checkout version and keep persist-credentials: true enabled. Setting CR_TOKEN alone does not persist checkout credentials for Git worktrees. The workflow also needs contents: write permission. If you use a custom token, pass it to both checkout's token input and CR_TOKEN.

Inputs

• version: The chart-releaser version to use (default: v1.10.1). The downloaded archive is verified against the release's checksums.txt before extraction.
• config: Optional config file for chart-releaser. For more information on the config file, see the documentation
• charts_dir: The charts directory
• charts: Optional newline-separated chart directory paths, relative to the checkout directory. When set, only these charts are processed, without Git change detection. Takes precedence over charts_dir and match_tags; cannot be combined with skip_packaging.
• ignore_paths: Optional newline-separated Bash glob patterns, relative to each chart root, to exclude from Git change detection. Patterns match paths of files within the chart, and * can match across /. For example, use README.md and .helmignore to ignore changes to those files. Empty by default, preserving existing behavior; this does not affect explicitly selected charts supplied through charts.
• package_path: Directory for chart packages, relative to the checkout (default: .cr-release-packages). Applies to packaging, GitHub release upload, index publishing, and OCI pushes.
• skip_packaging: This option, when populated, will skip the packaging step. This allows you to do more advanced packaging of your charts (for example, with the helm package command) before this action runs. This action will only handle the indexing and publishing steps.
• skip_existing: Skip package upload if release/tag already exists
• skip_upload: This option, when populated, will skip the upload step. This allows you to do more advanced uploading of your charts (for example with OCI based repositories) which doesn't require the index.yaml.
• skip_release: When set to true, no GitHub release is created and the index is not updated. Charts are only packaged into package_path (default: .cr-release-packages) and pushed to oci_registry_url when it is set, so you can publish them elsewhere (for example with actions/upload-artifact). CR_TOKEN is not required in this mode. Cannot be combined with packages_with_index.
• mark_as_latest: When set to false, the created GitHub release will not be marked as the "latest" release on the repository's releases page.
• match_tags: The glob to use to filter Git tags, usually used with the CR_RELEASE_NAME_TEMPLATE environment variable (default: all tags)
• packages_with_index: When you set this to true, it will upload chart packages directly into publishing branch.
• pages_branch: Name of the branch to be used to push the index and artifacts. (default to: gh-pages but it is not set in the action it is a default value for the chart-releaser binary)
• oci_registry_url: OCI registry URL (e.g. oci://ghcr.io/myorg/charts). When set, the action additionally pushes each packaged chart to this OCI registry via cr push. For authentication, the recommended approach is to run docker/login-action before this action so credentials are placed in the local registry credential store; alternatively pass oci_username / oci_password explicitly.
• oci_username: Username for OCI registry authentication. Falls back to the local registry credential store (e.g. ~/.docker/config.json populated by docker/login-action, helm registry login, or docker login) when unset.
• oci_password: Password or token for OCI registry authentication. Falls back to the local registry credential store when unset.

Outputs

• changed_charts: A comma-separated list of charts that were released on this run. Will be an empty string if no updates were detected, will be unset if --skip_packaging is used: in the latter case your custom packaging step is responsible for setting its own outputs if you need them.
• chart_version: The version of the most recently generated charts, as a comma-separated list of <name>-<version> entries.
• releases: A JSON array of objects with chart, version, and tag fields for each processed chart. chart is the name from Chart.yaml; tag uses chart-releaser's default {{ .Name }}-{{ .Version }} format. The output is [] when no charts were detected and is unset when skip_packaging is used. Requires jq on the runner.

Errors reported by chart-releaser or the action are surfaced as GitHub Actions annotations. The matcher highlights the error text but does not map it to a specific chart source line.

Explicit chart processing

Supply chart directories to package selected charts even when Git reports no changes, such as in a manually triggered workflow:

- name: Release selected charts
  uses: helm/chart-releaser-action@main
  with:
    charts: |
      charts/my-chart
      generated/another-chart
  env:
    CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

Paths may contain spaces, and each selected directory must contain Chart.yaml. Duplicate paths to the same directory are processed once. All paths are validated before packaging starts. changed_charts lists the selected directories that were processed and chart_version lists their packaged <name>-<version> entries.

This bypasses discovery only. Versions still come from Chart.yaml. Existing releases fail unless skipping or replacement is enabled. Leave charts unset to retain automatic discovery, or use skip_packaging without charts when packaging charts yourself.

Replacing an existing chart version

With chart-releaser v1.10.0 or later, set CR_REPLACE_EXISTING: "true" to replace the archive and optional provenance of an existing mutable GitHub release and refresh that version's index metadata, URLs, and checksum. The environment variable applies to both upload and index commands. Use charts to process the selected chart even when Git detects no changes:

- name: Replace selected chart
  uses: helm/chart-releaser-action@main
  with:
    charts: charts/my-chart
    # Optional: also replace packages hosted on the Pages branch.
    # packages_with_index: true
  env:
    CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
    CR_REPLACE_EXISTING: "true"

Keep the version in Chart.yaml unchanged to replace that version. Release identity, tag, notes, other release metadata, and unrelated assets are preserved. Replacing a signed package with an unsigned package removes stale provenance. Immutable releases cannot be replaced; publish a new chart version instead.

Do not combine replacement with skip_existing or CR_SKIP_EXISTING, and leave skip_upload unset so the index is updated. For packages_with_index: true, enable replacement through the environment variable as shown above; this disables the action's automatic --skip-existing flag. Setting only replace-existing in a CLI config file does not disable that automatic flag. Default Pages behavior still skips existing releases and preserves existing packages.

Serialize publishing jobs, for example with a workflow-level concurrency group shared by all publishers of the same repository:

concurrency:
  group: chart-publishing-${{ github.repository }}
  cancel-in-progress: false

Release assets and Pages/index updates are separate operations. If interrupted, inspect reported temporary assets and rerun upload and index with the same packages; retain the original archives and provenance and use skip_packaging: true for recovery. Consumers may cache previously published bytes, so publishing a new version is generally preferable. See the CLI replacement documentation for recovery details.

Environment variables

• CR_TOKEN (required unless skip_release is true): The GitHub token of this repository (${{ secrets.GITHUB_TOKEN }})
• CR_REPLACE_EXISTING: Set to "true" to replace existing mutable chart assets and refresh matching index entries. Requires chart-releaser v1.10.0 or later; see replacement.

For more information on environment variables, see the documentation.

Release notes

To include GitHub-generated changelog text and pull request links in releases, enable CR_GENERATE_RELEASE_NOTES:

- name: Run chart-releaser
  uses: helm/[email protected]
  env:
    CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
    CR_GENERATE_RELEASE_NOTES: "true"

The default CLI v1.10.1 compares against the previous tag of the same chart when one can be identified. First releases, unsupported release-name templates, and lookup failures fall back to GitHub's default generation behavior. Generated notes cover the commit range between tags; they do not filter pull requests by chart directory, so a monorepo release can include changes to other charts.

For notes specific to each chart, prepare a Markdown file inside each chart before packaging, then select it with a config file:

# cr.yaml, passed through the action's config input
release-notes-file: RELEASE_NOTES.md
generate-release-notes: false

The file path is relative to each chart root, such as charts/my-chart/RELEASE_NOTES.md, and the file must be included in the chart package. The CLI uses its entire contents as the release body; it does not automatically extract a version section from a full changelog. If the file is absent, the chart description is used instead. Set generate-release-notes: true to append GitHub-generated notes to that body. The equivalent environment variables are CR_RELEASE_NOTES_FILE and CR_GENERATE_RELEASE_NOTES.

Example Workflow

Create a workflow (eg: .github/workflows/release.yml):

name: Release Charts

on:
  push:
    branches:
      - main

jobs:
  release:
    # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions
    # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "[email protected]"

      - name: Run chart-releaser
        uses: helm/[email protected]
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

This uses @helm/chart-releaser-action to turn your GitHub project into a self-hosted Helm chart repo. It does this – during every push to main – by checking each chart in your project, and whenever there's a new chart version, creates a corresponding GitHub release named for the chart version, adds Helm chart artifacts to the release, and creates or updates an index.yaml file with metadata about those releases, which is then hosted on GitHub Pages. You do not need an index.yaml file in main at all because it is managed in the gh-pages branch.

Example using custom config

workflow.yml:

- name: Run chart-releaser
  uses: helm/[email protected]
  with:
    charts_dir: charts
    config: cr.yaml
  env:
    CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

cr.yaml:

owner: myaccount
git-base-url: https://api.github.com/

For options see config-file.

Custom index locations

Use the config input to set the CLI's index-path and pages-index-path options:

- name: Run chart-releaser
  uses: helm/[email protected]
  with:
    config: cr.yaml
    pages_branch: gh-pages
  env:
    CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

cr.yaml:

index-path: site/static/index.yaml
pages-index-path: docs/index.yaml

index-path is the generated file in the workflow checkout, which a later site-build step can use. pages-index-path is the index location relative to the publishing branch; the example publishes docs/index.yaml on gh-pages. Set pages_branch to another existing branch if your documentation source lives there, and use a path such as docs/static/index.yaml if needed. Both paths should end in index.yaml. If another workflow rebuilds the published site, include the index in its build output so it is preserved.

For a custom publishing subdirectory, leave packages_with_index disabled (the default), so chart URLs point to GitHub release assets. When packages_with_index: true is used, the CLI stores chart archives at the publishing branch root; keep pages-index-path: index.yaml so its relative package URLs resolve correctly. You can still customize the local index-path.

Example pushing to an OCI registry

When oci_registry_url is set, the action pushes each packaged chart to the OCI registry in addition to (or instead of) the GitHub Pages flow. The recommended way to authenticate is by running docker/login-action earlier in the job so the registry credential store is populated; cr push then picks them up automatically.

- name: Log in to the OCI registry
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

- name: Run chart-releaser
  uses: helm/[email protected]
  with:
    oci_registry_url: oci://ghcr.io/${{ github.repository_owner }}/charts
  env:
    CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

If you prefer to pass credentials directly to the action instead of using docker/login-action, set the oci_username and oci_password inputs.

To push to the OCI registry only, without creating GitHub releases or updating the GitHub Pages index, set skip_release: true:

- name: Run chart-releaser
  uses: helm/[email protected]
  with:
    oci_registry_url: oci://ghcr.io/${{ github.repository_owner }}/charts
    skip_release: true

Code of conduct

Participation in the Helm community is governed by the Code of Conduct.