Trigger publish-helm-chart via workflow_call from create-release

v6 rc.1 → rc.5 published successfully but the Helm chart never landed on
rcourtman.github.io/Pulse/index.yaml — the index still ends at v5.1.30.
`helm install pulse pulse/pulse --version 6.0.0-rc.5` returns
chart-not-found; without `--version` helm pulls the latest published
chart (v5.1.30) into a customer's v6 cluster.

Root cause: GitHub does not fire `release: published` for releases that
were created as drafts and later PATCHed to draft=false. create-release.yml
deliberately uses that path so it can upload assets and run
validate-release-assets against the draft before promoting. Inspection of
the workflow run history confirms: every gh-API `release: published` event
since 2026-03-02 has been from manually-dispatched v5 stable cuts; zero
fired for v6 RCs published through the create-release pipeline.

Fix the same way install-sh-smoke was wired in commit 7c0f65425: add a
`workflow_call` trigger to publish-helm-chart.yml and call it explicitly
from create-release.yml as a downstream of validate_release_assets. The
chart-version resolver in publish-helm-chart now accepts inputs from
either workflow_call or workflow_dispatch and only falls back to the
release-event tag when no inputs are present, keeping the legacy
release-event path working for forks / manual gh-CLI publishes that
create with draft=false from the start.

Pinned in build_release_assets_test.go:
- create-release.yml wiring (publish_helm_chart job, version inputs)
- publish-helm-chart.yml workflow_call trigger declaration
- chart-version resolver's input-priority logic

Contract delta in deployment-installability.md Extension Point 7
documents the workflow_call requirement and forbids relying on the
release-published webhook for the create-release.yml draft-promotion
path.

The fix takes effect on the next release through the pipeline. Backfill
of the v6.0.0-rc.5 chart needs a one-time manual dispatch of
publish-helm-chart.yml against chart_version=6.0.0-rc.5.

.github/workflows/create-release.yml

@@ -1089,3 +1089,26 @@ jobs:
       tag: ${{ needs.prepare.outputs.tag }}
       version: ${{ needs.prepare.outputs.version }}
       repository: ${{ github.repository }}
+
+  # Publish the Helm chart for this release. publish-helm-chart.yml also
+  # listens for `release: published` events directly, but the create_release
+  # publish step PATCHes a draft release to draft=false rather than creating
+  # it as draft=false from the start — that GitHub-documented path does NOT
+  # fire `release: published`. Across v6 rc.1 → rc.5 the release-event branch
+  # never triggered helm publish, leaving rcourtman.github.io/Pulse/index.yaml
+  # without any v6 chart and breaking `helm install pulse pulse/pulse
+  # --version 6.0.0-rc.5`. Calling the workflow explicitly here is the
+  # canonical fix.
+  publish_helm_chart:
+    needs:
+      - prepare
+      - validate_release_assets
+    if: ${{ always() && needs.prepare.result == 'success' && needs.validate_release_assets.result == 'success' && needs.prepare.outputs.historical_asset_backfill_only != 'true' }}
+    permissions:
+      contents: write
+      packages: write
+    uses: ./.github/workflows/publish-helm-chart.yml
+    secrets: inherit
+    with:
+      chart_version: ${{ needs.prepare.outputs.version }}
+      app_version: ${{ needs.prepare.outputs.version }}

.github/workflows/publish-helm-chart.yml

@@ -1,8 +1,31 @@
 name: Publish Helm Chart
 
+# Triggers:
+# - release: published — fires when a release is initially created with
+#   draft=false (legacy publish path).
+# - workflow_call — called from create-release.yml after validate_release_assets
+#   succeeds. create-release.yml's publish step creates releases as drafts and
+#   PATCHes to draft=false later, which does NOT fire the `release: published`
+#   webhook (GitHub-documented quirk). Without this workflow_call trigger,
+#   v6 rc.1 → rc.5 published successfully but never produced a Helm chart on
+#   rcourtman.github.io/Pulse/index.yaml — customers running
+#   `helm install pulse pulse/pulse --version 6.0.0-rc.5` got chart-not-found.
+# - workflow_dispatch — manual backfill / re-publish path.
+
 on:
   release:
     types: [published]
+  workflow_call:
+    inputs:
+      chart_version:
+        description: "Chart version (e.g., 6.0.0-rc.5). Required for workflow_call."
+        required: true
+        type: string
+      app_version:
+        description: "Application version to embed (defaults to chart version)."
+        required: false
+        type: string
+        default: ""
   workflow_dispatch:
     inputs:
       chart_version:
@@ -25,22 +48,26 @@ jobs:
     steps:
       - name: Determine chart version
         id: versions
+        env:
+          INPUT_CHART_VERSION: ${{ inputs.chart_version }}
+          INPUT_APP_VERSION: ${{ inputs.app_version }}
+          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            CHART_VERSION="${{ inputs.chart_version }}"
-            if [ -z "$CHART_VERSION" ]; then
-              echo "::error::chart_version input is required when running manually"
-              exit 1
-            fi
-            APP_VERSION="${{ inputs.app_version }}"
+          # inputs.chart_version is set by both workflow_dispatch and
+          # workflow_call (from create-release.yml). Fall back to the
+          # release-event tag only when running from a `release: published`
+          # webhook with no inputs.
+          if [ -n "${INPUT_CHART_VERSION}" ]; then
+            CHART_VERSION="${INPUT_CHART_VERSION}"
+            APP_VERSION="${INPUT_APP_VERSION}"
             if [ -z "$APP_VERSION" ]; then
               APP_VERSION="$CHART_VERSION"
             fi
             RELEASE_TAG="v${CHART_VERSION}"
           else
-            RELEASE_TAG="${{ github.event.release.tag_name }}"
+            RELEASE_TAG="${RELEASE_TAG_NAME}"
             if [ -z "$RELEASE_TAG" ]; then
-              echo "::error::Release tag is empty"
+              echo "::error::No chart_version input supplied and release event has no tag_name"
               exit 1
             fi
             CHART_VERSION="${RELEASE_TAG#v}"

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -317,6 +317,18 @@ server-side update execution surfaces.
    default. `scripts/validate-release.sh` must assert the
    `/usr/local/bin/pulse-agent` symlink exists, points at one of the
    supported Linux arch binaries, and is executable in the published image.
+   `create-release.yml` must trigger `publish-helm-chart.yml` via an explicit
+   `workflow_call` after `validate_release_assets` succeeds, not rely on
+   GitHub's `release: published` webhook. The webhook does not fire when a
+   release is created as draft and later PATCHed to `draft=false` (the path
+   `create-release.yml` uses for draft validation), so without the explicit
+   call the chart silently never publishes — v6 rc.1 through rc.5 all
+   shipped without any chart on the GitHub Pages helm index. The
+   `publish-helm-chart.yml` workflow must therefore expose a `workflow_call`
+   input schema (`chart_version`, `app_version`) alongside the legacy
+   `release` and `workflow_dispatch` triggers, and its chart-version
+   resolver must prefer inputs over the release-event tag when inputs are
+   present so all three entry paths converge on the same identity.
    Generated chart docs are part of the packaged release artifact, not a
    disposable byproduct: when the stable candidate version changes, the checked
    in `deploy/helm/pulse/README.md` output must be regenerated from the same

scripts/installtests/build_release_assets_test.go

@@ -173,6 +173,16 @@ func TestCreateReleaseUploadsPowerShellInstaller(t *testing.T) {
 		`needs.validate_release_assets.result == 'success'`,
 		`needs.prepare.outputs.historical_asset_backfill_only != 'true'`,
 		`repository: ${{ github.repository }}`,
+		// Helm chart publish must be called explicitly from create-release
+		// because the draft→PATCH(draft=false) publish path does NOT fire
+		// the `release: published` webhook (GitHub-documented quirk). v6
+		// rc.1 → rc.5 published successfully but never produced a Helm
+		// chart on the GitHub Pages index, breaking
+		// `helm install pulse pulse/pulse --version 6.0.0-rc.X`.
+		`uses: ./.github/workflows/publish-helm-chart.yml`,
+		`publish_helm_chart:`,
+		`chart_version: ${{ needs.prepare.outputs.version }}`,
+		`app_version: ${{ needs.prepare.outputs.version }}`,
 	}
 	for _, needle := range required {
 		if !strings.Contains(workflow, needle) {
@@ -940,6 +950,40 @@ func TestInstallShSmokeWorkflowPresent(t *testing.T) {
 	}
 }
 
+func TestPublishHelmChartReachableViaWorkflowCall(t *testing.T) {
+	// v6 rc.1 → rc.5 published successfully but never published a Helm
+	// chart because `release: published` does not fire when a release is
+	// created as draft and later PATCHed to draft=false (the path
+	// create-release.yml uses). The fix is an explicit workflow_call from
+	// create-release.yml — wired in `publish_helm_chart` job — that runs
+	// after validate_release_assets succeeds. Both the trigger declaration
+	// on publish-helm-chart.yml and the wiring in create-release.yml must
+	// be present; reverting either reopens the chart-not-published gap.
+	workflowBytes, err := os.ReadFile(repoFile(".github", "workflows", "publish-helm-chart.yml"))
+	if err != nil {
+		t.Fatalf("read publish-helm-chart.yml: %v", err)
+	}
+	workflow := string(workflowBytes)
+	required := []string{
+		`workflow_call:`,
+		`chart_version:`,
+		`description: "Chart version (e.g., 6.0.0-rc.5). Required for workflow_call."`,
+		`required: true`,
+		`type: string`,
+		`app_version:`,
+		// The chart-version resolver must accept inputs from both
+		// workflow_call and workflow_dispatch, falling back to the
+		// release-event tag only when no inputs are present.
+		`if [ -n "${INPUT_CHART_VERSION}" ]; then`,
+		`RELEASE_TAG="${RELEASE_TAG_NAME}"`,
+	}
+	for _, needle := range required {
+		if !strings.Contains(workflow, needle) {
+			t.Fatalf("publish-helm-chart.yml missing required workflow_call wiring: %s", needle)
+		}
+	}
+}
+
 func TestHelmAgentRuntimePointsAtRealImage(t *testing.T) {
 	// The helm chart's agent.enabled=true workload used to default to
 	// ghcr.io/rcourtman/pulse-agent — an image that was never published.