fix: Refuse helm chart publish when version already exists

[VedantMadane]

Summary

Refuse helm chart publish when version already exists

Changes

• fail publish when chart version already exists (no silent overwrite)

Fixes #324

[github-actions]

Rosetta Triage Review

Summary: Adds a "Refuse overwrite of existing chart version" step to the publish job in publish-mcp-helm-chart.yml, intended to abort the Helm chart publish if the Chart.yaml version is already pushed. Addresses #324.

Findings:

• The new step runs at the job's default working directory (repo root), but Chart.yaml lives at src/helm-charts/rosetta-mcp-server/Chart.yaml. grep -E "^version:" Chart.yaml reads a nonexistent file at repo root, not the chart's actual Chart.yaml. Every other version-reading step in this same file (both in validate and in the following Package and push step) explicitly sets CHART_PATH=./src/helm-charts/rosetta-mcp-server — the new step omits this.
• The registry the new step checks (oci://ghcr.io/<owner>/charts/<basename>) does not match the registry this workflow actually publishes to (registry-1.docker.io/griddynamics, per the Package and push Helm chart (OCI / Docker Hub) step directly below it). A version already published to Docker Hub would never be detected by this check; it queries a GHCR path this project does not appear to use.
• Because the new step's run block has set -euo pipefail and grep on a missing file exits non-zero, the workflow fails at this new step for every run, before ever reaching the actual package/push step — this blocks all future chart publishes, not just version collisions.

Caveats:

• The PR's own diff never touches or references CHART_PATH, which is the established convention in this file for locating the chart; the omission looks like an oversight rather than an intentional path choice.
• helm pull ... 2>/dev/null also swallows real network/auth errors from the registry check, which would be silently treated the same as "version not found" if the working-directory and registry issues were fixed but this pattern were kept.

Suggestions:

• Set CHART_PATH=./src/helm-charts/rosetta-mcp-server (matching the other steps) and read Chart.yaml from there.
• Check the registry this workflow actually publishes to (Docker Hub, registry-1.docker.io/griddynamics), not ghcr.io.
• Consider following the existing guard pattern in publish-rosetta-cli.yml (check_version step with explicit exists/version outputs, a dedicated Fail if version exists step) referenced in [ROSETTA] publish-mcp-helm-chart.yml pushes with no version-exists guard, silently overwriting published charts #324, for consistency and testability.

Questions:

• Was this tested against an actual publish run (workflow_dispatch or a real chart-path push), or only reviewed statically? The working-directory issue would surface immediately on any real run.

Automated triage by Rosetta agent

[isolomatov-gd]

@VedantMadane thank you for picking this up.

The new step needs three fixes before it can merge:

1. Read version and name from src/helm-charts/rosetta-mcp-server/Chart.yaml. The step runs at the repo root, where there is no Chart.yaml. With set -euo pipefail, the grep fails and every chart publish stops at this step.
2. Check the registry that the workflow pushes to: oci://registry-1.docker.io/griddynamics/<chart name>. The step checks ghcr.io/<owner>/charts/$(basename $(pwd)). That path resolves to .../charts/rosetta. The chart name is rosetta-mcp-helm-chart, and the project does not publish to GHCR. So an existing version is never found.
3. Keep registry errors visible. 2>/dev/null makes a network or auth failure look like "version not published", and the push then overwrites the chart.

Use the check_version and Fail if version exists steps in publish-rosetta-cli.yml as the pattern. Read CHART_PATH the same way the existing push step does.

The publish job runs only on main, so PR CI never runs this step. Please run the check locally against the current chart version (0.4.3, which is already published) and paste the output. The expected result is "already published".

[VedantMadane]

Addressed @isolomatov-gd review:

1. Read version / name from src/helm-charts/rosetta-mcp-server/Chart.yaml (same CHART_PATH as the push step).
2. Probe oci://registry-1.docker.io/griddynamics/<chart name> (not GHCR / basename pwd).
3. Dropped 2>/dev/null; non-not-found pull failures fail the job. Split into check_version + Fail if version exists (publish-rosetta-cli pattern); push only when exists=false.

Local check (current chart 0.4.3 / rosetta-mcp-helm-chart):

helm pull oci://registry-1.docker.io/griddynamics/rosetta-mcp-helm-chart --version 0.4.3
# exit 0 — Pulled: ...:0.4.3
# Digest: sha256:88b9ee44d3e01f892695f3bce195973263a20f7e114df20e274849c9fcdcbaae

So the check correctly treats 0.4.3 as already published.

Head: 6d621ca

[VedantMadane]

Hi @isolomatov-gd — gentle re-review bump. Head 6d621ca addresses the three points (Chart.yaml path, Docker Hub OCI probe, visible helm pull errors). Local helm pull … --version 0.4.3 confirmed already-published. Thanks!

[VedantMadane]

Verified CR items on head 6d621ca:

1. Reads version and name from src/helm-charts/rosetta-mcp-server/Chart.yaml (not repo-root Chart.yaml)
2. Checks oci://registry-1.docker.io/griddynamics/<chart name> (the push target), not ghcr
3. Fails the job when the version already exists; allows publish only when pull reports not-found

[github-actions]

Rosetta Triage Review

Summary: This PR adds a pre-publish Helm OCI probe and fails when the chart version is already published, preventing an in-place overwrite.

Findings:

• Confirmed: the probe reads the chart name and version from src/helm-charts/rosetta-mcp-server/Chart.yaml and checks the Docker Hub OCI target.
• The failure classifier is not fail-closed as stated. Its no such match also accepts a DNS failure such as no such host as a missing chart, then permits publishing.
• No CI checks are reported for the branch, so the changed workflow has no recorded validation run.

Suggestions:

• Match only the documented Helm/OCI missing-manifest response, or explicitly reject DNS, transport, authentication, and registry failures before treating the version as new.

Automated triage by Rosetta agent