[stelioschar]

Summary

Publish Edge release metadata on every chart release, and gate it on a test of the values the NOFire AI dashboard sets (NOFireAI/engineering#1983).

• release.yml writes edge/<version>.json and edge/latest.json to releases.nofire.ai through an OIDC role (NOFireAI/terraform#295):
  • the versioned file is written once, with If-None-Match;
  • latest.json only moves to a higher version, never to a pre-release, and is read from S3 directly so a cached copy cannot hide a newer one;
  • it waits until GitHub Pages serves an index.yaml that lists the version, so helm repo update can always find what latest.json names;
  • the steps run on every run and each write is idempotent. A re-run changes nothing, and a manual run publishes 0.10.0, which predates this;
  • they are skipped until the RELEASE_METADATA_ROLE_ARN repository variable is set.
• tests/dashboard_install_test.yaml sets each value the dashboard's install, sources and disconnect commands set, and asserts it reaches the rendered config. Helm ignores keys a chart does not read, so a rename would otherwise render cleanly and lose the token, cluster name, netobs switch or a source.
• Render case dashboard-reuse-from-0.9.0: 0.9.0's values plus what the dashboard set on that release, rendered onto this chart as --reuse-values does. This is what the dashboard's step 5 and disconnect commands do.

Once the dashboard follows latest.json (NOFireAI/dashboard#1445), a chart release reaches customers with no dashboard PR, so these tests are the review step.

Testing

• The publish script ran against stubbed aws, gh and curl. Each case behaved as intended:
  • an empty bucket;
  • an older latest.json;
  • a re-run;
  • a backfill of an older version;
  • a pre-release;
  • 0.9.9 against 0.10.0;
  • S3 returning 500, which fails the step.
• helm template with the suite's values passes every assertion's pattern. The reuse case renders, and its expect.jq holds. helm-unittest itself was not run locally; CI runs it.

Notes

• id-token: write is added to the job.
• Under --reuse-values the reuse case still renders image v3.9.0, because 0.9.0's values set image.tag. Existing installs pick up new templates but not the new image until the dashboard moves to --reset-then-reuse-values (NOFireAI/dashboard#1445).
• Opened from a fork: I have read access only.
• Written with help from Claude Code.

---

Closes #27
Refs: NOFireAI/engineering#1983, NOFireAI/terraform#295

🤖 Generated with Claude Code