Problem
Server main declares Helm chart 0.1.24 with appVersion: 2.0.0-rc.33, and the chart README advertises that exact version through both the GHCR OCI repository and https://durable-workflow.github.io/charts/.
Neither command is currently consumable. Anonymous GHCR manifest reads return MANIFEST_UNKNOWN for 0.1.24 (and 0.1.23), with public tags ending at 0.1.20. The HTTPS index still contains only chart 0.1.1 for Server 2.0.0-rc.11.
The chart publisher can defer a protected-main chart change until its immutable Server image exists. The Server release workflow later publishes the image, but invokes the matching chart publisher only when the entire publish job succeeds. A failure in a later docs-readiness step therefore skips chart publication even though the image is already public. The verification-only recovery path verifies the images, GitHub Release, and docs classification, but does not recover the deferred chart. The HTTPS mirror consequently has no current OCI chart to stage and remains on an older version.
Acceptance criteria
- Publish chart
0.1.24 anonymously through both documented channels with identical package bytes and provenance bound to Server 2.0.0-rc.33, its immutable source revision, and public image digest.
- Prove a clean Helm client can install the exact README command independently from OCI and HTTPS.
- Give a deferred chart an idempotent recovery path once its immutable Server image exists, without rebuilding, repushing, or retagging that image or mutating the existing GitHub Release.
- Do not make matching chart publication depend on unrelated later release classification succeeding; retain precise evidence when image publication succeeds but docs or another downstream check fails.
- Deterministically hand a newly published OCI chart to the HTTPS mirror, and fail release verification when either advertised channel is missing, stale, or byte-different.
- Add regression coverage for a failure after image publication but before the chart job, followed by verification-only recovery.
- Preserve the pre-v2-stable boundary; this work does not authorize stable
2.0.0.
Delete when
Delete when both public channels anonymously serve and clean-install the same chart 0.1.24, and automated recovery prevents a later partially successful Server release from leaving an advertised chart version unpublished.
Required source targets
durable-workflow/durable-workflow.github.io@main
durable-workflow/server@main
Problem
Server
maindeclares Helm chart0.1.24withappVersion: 2.0.0-rc.33, and the chart README advertises that exact version through both the GHCR OCI repository andhttps://durable-workflow.github.io/charts/.Neither command is currently consumable. Anonymous GHCR manifest reads return
MANIFEST_UNKNOWNfor0.1.24(and0.1.23), with public tags ending at0.1.20. The HTTPS index still contains only chart0.1.1for Server2.0.0-rc.11.The chart publisher can defer a protected-main chart change until its immutable Server image exists. The Server release workflow later publishes the image, but invokes the matching chart publisher only when the entire publish job succeeds. A failure in a later docs-readiness step therefore skips chart publication even though the image is already public. The verification-only recovery path verifies the images, GitHub Release, and docs classification, but does not recover the deferred chart. The HTTPS mirror consequently has no current OCI chart to stage and remains on an older version.
Acceptance criteria
0.1.24anonymously through both documented channels with identical package bytes and provenance bound to Server2.0.0-rc.33, its immutable source revision, and public image digest.2.0.0.Delete when
Delete when both public channels anonymously serve and clean-install the same chart
0.1.24, and automated recovery prevents a later partially successful Server release from leaving an advertised chart version unpublished.Required source targets
durable-workflow/durable-workflow.github.io@main
durable-workflow/server@main