Skip to content

Add cr index --rebuild and use release publish times as created - #680

Open
cvas22 wants to merge 2 commits into
helm:mainfrom
cvas22:feat/133-index-rebuild
Open

cvas22 wants to merge 2 commits into
helm:mainfrom
cvas22:feat/133-index-rebuild

Conversation

@cvas22

@cvas22 cvas22 commented Nov 2, 2026 •

Copy link
Copy Markdown

Fixes #133

This adds cr index --rebuild and makes each chart version's created time the time its GitHub release was published, as I proposed in #133.

  • --rebuild: instead of adding the packages in --package-path to the existing index, cr index lists all published releases of the repository (drafts are skipped), downloads their .tgz assets, and builds a new index from them. Assets that aren't chart packages are skipped with a message. Releases are added oldest first, so if a version is in more than one release, the oldest one wins, like publishing them one by one would (the newest with --replace-existing). Versions in the existing index without a release are dropped.
  • Stable created: the entry's created is the release's published_at, with and without --rebuild. Rebuilding the same releases therefore gives the same entries. When they match the existing index, cr index reports that the index did not change and doesn't write or commit it.
  • URLs follow the same rules as today (--packages-with-index, --use-api-asset-url), and --push, --pr and --sign-commits work the same way.

The GitHub client gets ListReleases (paginated) and DownloadReleaseAsset (uses the API asset endpoint, so it works with --token for private repos). Release now carries PublishedAt, and Asset carries the asset ID.

Notes

  • maybeAddToIndexFile now takes the directory to read the package from and the creation time, so the rebuild can reuse it for downloaded packages. Existing tests were updated for the new signature.
  • Tests: TestReleaser_UpdateIndexFileRebuild covers release order, non-chart assets, digests, URLs, idempotent reruns and dropped versions. TestReleaser_UpdateIndexFileRebuildKeepsFirstRelease covers a version in two releases, TestReleaser_UpdateIndexFileCreatedFromRelease covers created without --rebuild, and TestClient_ListReleases / TestClient_DownloadReleaseAsset cover the client against an httptest server.
  • I ran the tests on Windows. TestSignedIndexCommit, TestReleaser_CreateReleases, TestReleaser_CreateReleasesSkipExistingPages and TestReplaceReleaseAssetsPreflight fail there on main too (path separators and OS error messages), so I'm relying on CI for those.
  • Human did the initial design. AI helped with refinement, dev, and tests. Everything was edited, validated, and checked, and reviewed by a human and PR was created.

cr index --rebuild builds the index from the chart packages of all
published GitHub releases instead of adding the supplied packages to the
existing index. Each chart version is created at the time its release was
published, also for new versions without --rebuild, so the created field
matches the release date and rebuilding the same releases is idempotent.

Fixes helm#133

Signed-off-by: Srinivas Chippagiri <cvas22@gmail.com>

@cpanato cpanato left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please address the inline finding before merging. A focused unit test for duplicate releases with identical package bytes and --replace-existing --packages-with-index should cover this case; an external GitHub E2E test is not necessary.

Comment thread pkg/releaser/releaser.go
return false, err
}
candidate := replacement.Entries[c.Name()][0]
if !created.IsZero() {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please include Created in the replacement equality check below. During --rebuild --replace-existing --packages-with-index, when the same chart version and package bytes appear in multiple releases, the newer candidate has the same digest and relative URL as the existing entry. The early return then keeps the older Created timestamp, so documented newest-release-wins behavior is not honored. Add a focused regression test for duplicate releases with identical package bytes.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, you're right. When the creation time comes from a release, the equality check now also compares Created, so a newer release of the same package replaces the entry and the newest release wins. Without a release time (the normal, non-rebuild path) the check is unchanged, so repeated runs still don't rewrite identical entries. I added TestReleaser_maybeAddToIndexFileReplaceExistingSamePackage, which adds the same package for an older and a newer release with --replace-existing and --packages-with-index, and fails without the change. On my Windows machine some other tests in the package, such as TestReleaser_CreateReleases, fail with and without this change, so I'm relying on CI for those.

@cpanato

cpanato commented Nov 2, 2026

Copy link
Copy Markdown
Member

Could you let us know whether AI tools were used to prepare this PR? If so, please disclose that in the PR description and briefly note the extent of use.

…hen rebuilding

Signed-off-by: Srinivas Chippagiri <cvas22@gmail.com>
@cvas22

cvas22 commented Nov 3, 2026

Copy link
Copy Markdown
Author

@cpanato Updated the description. Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Optionally build index.yaml in an idempotent fashion

2 participants