update-helm-repo: fix oci image push failure

[narqo]

This is the fixup for #3366

Relates to #3068

It turned out GitHub doesn't support publishing a package using GitHub App installation tokens (or fine-grained personal tokens). That is, as of today, the users are left with using either "classic" PAT with org-scopes or the magical GITHUB_TOKEN (docs).

This PR fixes the update-helm-repo workflow, updating the last step to use the GITHUB_TOKEN token. Otherwise, the workflow fails with:

Run helm push "/home/runner/work/mimir/mimir/.cr-release-packages/mimir-distributed-5.6.0-weekly.315.tgz" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/helm-charts"
Error: unexpected status from POST request to https://ghcr.io/v2/grafana/helm-charts/mimir-distributed/blobs/uploads/: 403 Forbidden

Note that, the package is pushed to the GITHUB_REPOSITORY_OWNER repository, under the name helm-charts/<chart-name>. The package than is automatically associated with the source repository that ran the push. This is similar to how helm-chart/grafana-operator is published currently (ref).

[dimitarvdimitrov]

we still create a GH release. Don't we still need contents

helm-charts/.github/workflows/update-helm-repo.yaml

Lines 205 to 219 in 226cf91

	- name: Make github release
	uses: softprops/action-gh-release@v1
	with:
	body: |
	${{ steps.parse-chart.outputs.desc }}
	Source commit: https://github.com/${{ github.repository }}/commit/${{ github.sha }}
	Tag on source: https://github.com/${{ github.repository }}/releases/tag/${{ steps.parse-chart.outputs.tagname }}
	files: |
	${{ env.CR_PACKAGE_PATH }}/${{ steps.parse-chart.outputs.packagename }}.tgz
	${{ env.CR_PACKAGE_PATH }}/${{ steps.parse-chart.outputs.packagename }}.tgz.prov
	repository: grafana/helm-charts
	tag_name: ${{ steps.parse-chart.outputs.tagname }}
	token: ${{ env.AUTHTOKEN }}

[narqo]

As I understand it, the permissions only apply to GITHUB_TOKEN. But this workflow publishes the content via the app install token, which has the scope assigned when the app is installed.

Not that the workflow never had permissions. They were added only recently in the #3366 (I don't think this was necessary)

[dimitarvdimitrov]

so in effect #3383 which you opened was unnecessary?

[dimitarvdimitrov]

SGTM

[krajorama]

stamp

[pracucci]

👍