feat(ci): add automatic chart version bump workflow

.github/workflows/bump-version.yaml

@@ -0,0 +1,37 @@
+name: Bump Chart Version
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  bump-version:
+    if: "!contains(github.actor, 'oauth2-proxy-bot')"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ssh-key: "${{ secrets.PUSH_KEY }}"
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "oauth2-proxy-bot"
+          git config user.email "oauth2-proxy-bot@users.noreply.github.com"
+
+      - name: Bump Chart Version
+        uses: GarnerCorp/build-actions/bump-version@main
+        with:
+          version-type: raw
+          version-file-path: helm/oauth2-proxy/Chart.yaml
+          git-name: "oauth2-proxy-bot"
+          git-email: "oauth2-proxy-bot@users.noreply.github.com"
+          major: changelogs/major
+          minor: changelogs/minor

.github/workflows/lint-test.yaml

@@ -22,6 +22,16 @@ jobs:
       - name: Set up chart-testing
         uses: helm/chart-testing-action@v2.8.0
 
+      - name: Check changelog entry
+        run: |
+          if git diff --name-only origin/main...HEAD | grep -q '^helm/'; then
+            if ! git diff --name-only origin/main...HEAD | grep -qE '^changelogs/(major|minor)/[^.]+$'; then
+              echo "::error::Chart files changed but no changelog entry found."
+              echo "Add a file to changelogs/minor/ (new feature) or changelogs/major/ (breaking change)."
+              exit 1
+            fi
+          fi
+
       - name: Run chart-testing (list-changed)
         id: list-changed
         run: |

changelogs/README.md

@@ -0,0 +1,33 @@
+# Changelogs
+
+This directory drives the automatic version bump workflow.
+
+When a PR modifies the Helm chart, include a file in the appropriate subdirectory:
+
+- `minor/` — new feature (bumps `x.Y.0`)
+- `major/` — breaking change (bumps `X.0.0`)
+- No file needed for patch-only changes (CI fixes, doc tweaks) — the workflow defaults to patch
+
+## Filename
+
+Use a descriptive name matching your PR, e.g.:
+- `minor/add-runtimeclassname`
+- `major/breaking-tpl-extrainitcontainers`
+
+## File content
+
+Write a short description of the change. This becomes part of the version bump commit message.
+
+Example (`minor/add-runtimeclassname`):
+```
+Add optional runtimeClassName field to the Deployment spec, enabling
+users to run oauth2-proxy under alternative container runtimes such as
+gVisor or Kata Containers.
+```
+
+## How it works
+
+On merge to `main`, the `bump-version` workflow reads files from these
+directories, determines the bump type (major > minor > patch), updates
+`version:` in `helm/oauth2-proxy/Chart.yaml`, commits, and pushes.
+The changelog files are deleted as part of that commit.