feat(ci): add automatic chart version bump workflow

[pierluigilenoci]

Summary

This PR introduces an automatic chart version bump workflow inspired by the pattern described by @jsoref in #410.

The problem today: Every PR that touches the Helm chart must manually bump version: in Chart.yaml. Concurrent PRs always conflict on this line, requiring constant rebases and coordination.

How this works:

• Contributors add a small file to changelogs/minor/ (new feature) or changelogs/major/ (breaking change) alongside their chart changes — no need to pick a version number.
• On merge to main, the bump-version workflow (using GarnerCorp/build-actions) reads those files, determines the bump type (major > minor > patch), updates version: in Chart.yaml, commits, and pushes.
• The changelog files are consumed (deleted) by that commit.
• Patch bumps happen automatically when no changelog file is present.

Changes

• .github/workflows/bump-version.yaml — new workflow that runs on push to main
• .github/workflows/lint-test.yaml — adds a check in CI that fails fast when chart files are modified without a changelog entry
• changelogs/README.md — documents the convention for contributors
• changelogs/minor/.gitkeep, changelogs/major/.gitkeep — seed the directories

Notes

• Requires a PUSH_KEY secret (deploy key with write access) so the bot commit can trigger downstream workflows.
• The !contains(github.actor, 'oauth2-proxy-bot') guard prevents the workflow from eating its own tail.
• This is an exploratory/RFC PR — happy to iterate on the approach before merging.

cc @jsoref @tuunit

[jsoref]

Some thoughts

[jsoref]

You'd probably want to do a bit more magic so that you can update this section:

manifests/helm/oauth2-proxy/Chart.yaml

Line 32 in 529c2f6

artifacthub.io/changes: |

We weren't actively maintaining helm charts, so it wasn't something I was worried about, but I'm starting to do more work with helm charts, so I might add that support myself...

[pierluigilenoci]

Good point! I added scripts/chart-version-parser.sh as a custom version-parser for the action. It handles both version: and the artifacthub.io/changes block — it reads the commit-log produced by next-version, extracts the kind (added/changed) and description from each changelog file, and rewrites the annotation in place.

Would love your thoughts on whether the approach is sound — especially the changelog parsing logic. Happy to iterate!

[jsoref]

It's pretty much what I envisioned when I designed this. Beyond this, I'd need some sample inputs and outputs to test it, but it feels about right.

[pierluigilenoci]

Great to hear — thanks for the validation! I'll add a few example inputs/outputs to the script's header comments to make it easier to test and reason about. Will update the PR shortly.

[pierluigilenoci]

Just pushed a fix and added the inline examples you mentioned. The script now has 5 documented test cases in the header (parse, update without log, two minor entries with PR refs, breaking change detection, no PR ref), and the changelog splice was rewritten in a single Python pass to avoid awk issues with multi-line strings containing slashes (URLs).

Tested locally — all 5 cases produce the expected output. Happy to add a proper bats test file if you think that's worth it.

[jsoref]

I'd pull this out of line as a script w/ .py instead of using python3 - ..., since your .sh script is bash, you'll have access to the current bash script's path (it may require some bash magic).

Or, you might replace the whole .sh with .py. -- Personally, by the time I've started writing Python, I prefer to switch entirely.

[pierluigilenoci]

Good call — I went ahead and rewrote the whole thing as scripts/chart-version-parser.py. The bash was just glue at that point anyway. All 5 test cases still pass, and the inline heredoc is gone entirely.