fix(ci): build fluent-bit image from a configurable upstream base tag

.github/workflows/build-fluentbit-image.yaml

@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - cmd/fluent-watcher/fluentbit/VERSION
+      - cmd/fluent-watcher/fluentbit/BASE_VERSION
   workflow_dispatch:
 
 env:
@@ -23,6 +24,8 @@ jobs:
 
     outputs:
       version: ${{ steps.determine-tags.outputs.version }}
+      base-version: ${{ steps.determine-tags.outputs.base-version }}
+      debug-base-version: ${{ steps.determine-tags.outputs.debug-base-version }}
       image-base-tag: ${{ steps.determine-tags.outputs.image-base-tag }}
       image-major-minor: ${{ steps.determine-tags.outputs.image-major-minor }}
 
@@ -39,6 +42,14 @@ jobs:
           VERSION_WITHOUT_V=${VERSION#v}
           MAJOR_MINOR=$(echo "$VERSION_WITHOUT_V" | cut -d. -f1-2)
 
+          # Upstream base image tag; may differ from VERSION when upstream ships a rebuild (e.g. 5.1.5-2)
+          BASE_VERSION=$(cat cmd/fluent-watcher/fluentbit/BASE_VERSION 2>/dev/null || echo "$VERSION")
+          DEBUG_BASE_VERSION="$BASE_VERSION"
+          if ! skopeo inspect --raw "docker://docker.io/fluent/fluent-bit:${BASE_VERSION}-debug" > /dev/null; then
+            echo "fluent/fluent-bit:${BASE_VERSION}-debug not found, using ${VERSION}-debug for the debug image"
+            DEBUG_BASE_VERSION="$VERSION"
+          fi
+
           if skopeo inspect "docker://${{ env.GHCR_REPO }}:${VERSION}"; then
             echo "${VERSION} tag already exists, assuming we're building a patch release!"
             LATEST_PATCH_VERSION=$(skopeo list-tags docker://${{ env.GHCR_REPO }} | grep -E "${VERSION}-[0-9]+" | sort | uniq | tail -1 | tr -d \" | cut -d'-' -f2 | tr -d ',')
@@ -52,6 +63,8 @@ jobs:
 
           {
             echo "version=$VERSION"
+            echo "base-version=$BASE_VERSION"
+            echo "debug-base-version=$DEBUG_BASE_VERSION"
             echo "image-base-tag=$IMAGE_BASE_TAG"
             echo "image-major-minor=$MAJOR_MINOR"
           } >> "$GITHUB_OUTPUT"
@@ -150,7 +163,7 @@ jobs:
           labels: ${{ needs.build-tags.outputs.labels }}
           provenance: false
           build-args:
-            FLUENT_BIT_BASE_VERSION=${{ needs.build-info.outputs.version }}
+            FLUENT_BIT_BASE_VERSION=${{ needs.build-info.outputs.base-version }}
           outputs: type=image,"name=${{ env.GHCR_REPO }},${{ env.DOCKERHUB_REPO }}",push-by-digest=true,name-canonical=true,push=true
 
       - name: Output image digests
@@ -212,7 +225,7 @@ jobs:
           labels: ${{ needs.build-tags.outputs.labels }}
           provenance: false
           build-args:
-            FLUENT_BIT_BASE_VERSION=${{ needs.build-info.outputs.version }}
+            FLUENT_BIT_BASE_VERSION=${{ needs.build-info.outputs.debug-base-version }}
           outputs: type=image,"name=${{ env.GHCR_REPO }},${{ env.DOCKERHUB_REPO }}",push-by-digest=true,name-canonical=true,push=true
 
       - name: Output image digests

.github/workflows/release-please.yaml

@@ -56,3 +56,13 @@ jobs:
             --field tag="${{ steps.release.outputs.tag_name }}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Trigger Helm chart sync
+        if: ${{ steps.release.outputs.release_created }}
+        run: |
+          gh workflow run sync-helm-charts.yaml \
+            --repo "${{ github.repository }}" \
+            --ref "${{ github.event.repository.default_branch }}" \
+            --field tag="${{ steps.release.outputs.tag_name }}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/sync-helm-charts.yaml

@@ -0,0 +1,93 @@
+name: Sync Helm charts
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to sync to fluent/helm-charts (e.g. v3.11.0)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    name: Open fluent/helm-charts PR
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ inputs.tag }}
+    steps:
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.HELM_CHARTS_APP_CLIENT_ID }}
+          private-key: ${{ secrets.HELM_CHARTS_APP_PRIVATE_KEY }}
+          owner: fluent
+          repositories: helm-charts
+
+      # Full history and tags are needed to build the changelog.
+      - name: Checkout fluent-operator
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Checkout fluent/helm-charts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: fluent/helm-charts
+          ref: main
+          path: helm-charts
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Install helm-docs
+        run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2
+
+      - name: Sync charts
+        run: hack/sync-helm-charts.sh "$TAG" helm-charts | tee "$RUNNER_TEMP/versions.txt"
+
+      - name: Open pull request
+        working-directory: helm-charts
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        run: |
+          user_id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
+          git config user.name "${APP_SLUG}[bot]"
+          git config user.email "${user_id}+${APP_SLUG}[bot]@users.noreply.github.com"
+
+          version=$(awk '$1 == "version:" { print $2; exit }' charts/fluent-operator/Chart.yaml)
+          branch="chore/fluent-operator-${TAG}"
+          title="chore(fluent-operator): Bump fluent-operator to v${version}"
+
+          git switch -c "$branch"
+          git add charts/fluent-operator charts/fluent-operator-fluent-bit-crds charts/fluent-operator-fluentd-crds
+          git commit -s -m "$title" -m "Syncs charts/* from fluent/fluent-operator@${TAG}."
+          # Force push so re-runs replace the previous attempt.
+          git push --force origin "$branch"
+
+          if [[ -n $(gh pr list --head "$branch" --state open --json number --jq '.[]') ]]; then
+            echo "PR for ${branch} already open; updated branch only"
+            exit 0
+          fi
+
+          {
+            echo "Updates fluent-operator charts to fluent-operator ${TAG}."
+            echo
+            sed 's/^/- /' "$RUNNER_TEMP/versions.txt"
+            echo
+            echo "Opened by the [Sync Helm charts](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) workflow. Review the generated CHANGELOG entries before merging."
+          } > "$RUNNER_TEMP/body.md"
+          gh pr create --base main --head "$branch" --title "$title" --body-file "$RUNNER_TEMP/body.md"

RELEASE.md

@@ -91,13 +91,26 @@ For a patch release against an older minor line (e.g. `v3.7.1`):
 
 ### Publish updated Helm chart
 
-The `appVersion` fields in the three chart `Chart.yaml` files in this repo are bumped automatically by the Release PR. After merging the Release PR, the chart still needs to be manually synced to [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/) where users install from:
+The charts in this repo are development copies. Users install from [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/), and the CHANGELOG for each chart lives there.
 
-- Copy the updated `charts/fluent-operator/` directory to a branch in `fluent/helm-charts`
-- Bump the chart `version` field (separate from `appVersion`) per the helm-charts versioning convention
-- Open a PR in `fluent/helm-charts`
+When a release is created, the [`release`](.github/workflows/release-please.yaml) workflow dispatches [`sync-helm-charts`](.github/workflows/sync-helm-charts.yaml), which runs [`hack/sync-helm-charts.sh`](hack/sync-helm-charts.sh) and opens a PR in `fluent/helm-charts` for the `fluent-operator`, `fluent-operator-fluent-bit-crds` and `fluent-operator-fluentd-crds` charts. The script:
 
-Do the same for the `fluent-operator-fluentd-crds` and `fluent-operator-fluent-bit-crds` charts.
+- Copies the charts from the release tag, keeping the helm-charts `Chart.yaml`, `CHANGELOG.md`, `README.md` and `_description.md`
+- Sets `appVersion` and bumps each chart `version` by the same level as the operator release (major, minor or patch)
+- Adds CHANGELOG entries from the conventional commits that touched each chart since the last published `appVersion`
+- Regenerates the chart READMEs with helm-docs
+
+Review the PR, tidy up the generated CHANGELOG entries if needed, and merge it. Merging publishes the charts.
+
+To re-run a sync, dispatch the [Sync Helm charts](https://github.com/fluent/fluent-operator/actions/workflows/sync-helm-charts.yaml) workflow with the release tag. The sync fails if the tag is not newer than the published `appVersion`, so patch releases on older minor lines need a manual chart release.
+
+To preview a sync locally, run the script against a `fluent/helm-charts` checkout and inspect the diff:
+
+```shell
+hack/sync-helm-charts.sh v3.11.0 ../helm-charts
+```
+
+The workflow authenticates to `fluent/helm-charts` with a GitHub App installed on that repo with `contents: write` and `pull-requests: write`. Its client ID is stored in the `HELM_CHARTS_APP_CLIENT_ID` variable and its private key in the `HELM_CHARTS_APP_PRIVATE_KEY` secret.
 
 ## Fluentd/Fluent-bit Images
 

cmd/fluent-watcher/fluentbit/BASE_VERSION

@@ -0,0 +1 @@
+5.1.5-2