ci: publish the kobe Helm chart as an OCI artifact on a helm_v* tag (#46)

The chart only exists as source in charts/kobe, so installing kobe means
cloning the repo. Publish it to Docker Hub as an OCI artifact so users
can `helm install oci://registry-1.docker.io/zondax/kobe --version <x>`.

Chart releases ride their own tag (helm_v<chart-version>), decoupled from
the operator's v* releases and reusing the existing Docker Hub
credentials. Before pushing, the workflow asserts the tag version equals
the chart's version: and that the operator image for the chart's
appVersion already exists, so a published chart can never carry a
mismatched version or point at an unbuilt operator image.

Author: 0xPxt

.github/workflows/publish-chart.yml

@@ -0,0 +1,62 @@
+name: Publish Helm Chart
+
+# Chart releases ride their own tag, decoupled from the operator's v* release
+# tags: push a `helm_v<chart-version>` tag (e.g. helm_v0.0.1) to publish the
+# chart. The tag version must match `version:` in charts/kobe/Chart.yaml, so the
+# published OCI version and the chart's declared version can never drift.
+on:
+  push:
+    tags: ["helm_v*"]
+  workflow_dispatch:
+
+concurrency:
+  group: publish-chart-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish-chart:
+    runs-on: kunobi-runners
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: azure/setup-helm@v4
+
+      - name: Assert tag version matches Chart.yaml
+        if: startsWith(github.ref, 'refs/tags/helm_v')
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          tag_version="${REF_NAME#helm_v}"
+          chart_version="$(grep -E '^version:' charts/kobe/Chart.yaml | awk '{print $2}' | tr -d '"')"
+          echo "tag version: $tag_version | Chart.yaml version: $chart_version"
+          if [ "$tag_version" != "$chart_version" ]; then
+            echo "::error::tag $REF_NAME (version $tag_version) does not match charts/kobe/Chart.yaml version $chart_version"
+            exit 1
+          fi
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Verify the operator image exists for this appVersion
+        run: |
+          app_version="$(grep -E '^appVersion:' charts/kobe/Chart.yaml | awk '{print $2}' | tr -d '"')"
+          image="zondax/kobe-operator:${app_version}"
+          echo "Checking $image exists..."
+          if ! docker manifest inspect "$image" >/dev/null 2>&1; then
+            echo "::error::operator image $image not found — cut the operator release (v${app_version}) before tagging the chart"
+            exit 1
+          fi
+
+      - name: Package & push Helm chart (OCI)
+        env:
+          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          helm registry login registry-1.docker.io -u "$DOCKERHUB_USER" -p "$DOCKERHUB_TOKEN"
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm dependency build charts/kobe
+          helm package charts/kobe
+          helm push kobe-*.tgz oci://registry-1.docker.io/zondax