fix: Refuse helm chart publish when version already exists

[VedantMadane]

Summary

Refuse helm chart publish when version already exists

Changes

• fail publish when chart version already exists (no silent overwrite)

Fixes #324

[github-actions]

Rosetta Triage Review

Summary: Adds a "Refuse overwrite of existing chart version" step to the publish job in publish-mcp-helm-chart.yml, intended to abort the Helm chart publish if the Chart.yaml version is already pushed. Addresses #324.

Findings:

• The new step runs at the job's default working directory (repo root), but Chart.yaml lives at src/helm-charts/rosetta-mcp-server/Chart.yaml. grep -E "^version:" Chart.yaml reads a nonexistent file at repo root, not the chart's actual Chart.yaml. Every other version-reading step in this same file (both in validate and in the following Package and push step) explicitly sets CHART_PATH=./src/helm-charts/rosetta-mcp-server — the new step omits this.
• The registry the new step checks (oci://ghcr.io/<owner>/charts/<basename>) does not match the registry this workflow actually publishes to (registry-1.docker.io/griddynamics, per the Package and push Helm chart (OCI / Docker Hub) step directly below it). A version already published to Docker Hub would never be detected by this check; it queries a GHCR path this project does not appear to use.
• Because the new step's run block has set -euo pipefail and grep on a missing file exits non-zero, the workflow fails at this new step for every run, before ever reaching the actual package/push step — this blocks all future chart publishes, not just version collisions.

Caveats:

• The PR's own diff never touches or references CHART_PATH, which is the established convention in this file for locating the chart; the omission looks like an oversight rather than an intentional path choice.
• helm pull ... 2>/dev/null also swallows real network/auth errors from the registry check, which would be silently treated the same as "version not found" if the working-directory and registry issues were fixed but this pattern were kept.

Suggestions:

• Set CHART_PATH=./src/helm-charts/rosetta-mcp-server (matching the other steps) and read Chart.yaml from there.
• Check the registry this workflow actually publishes to (Docker Hub, registry-1.docker.io/griddynamics), not ghcr.io.
• Consider following the existing guard pattern in publish-rosetta-cli.yml (check_version step with explicit exists/version outputs, a dedicated Fail if version exists step) referenced in [ROSETTA] publish-mcp-helm-chart.yml pushes with no version-exists guard, silently overwriting published charts #324, for consistency and testability.

Questions:

• Was this tested against an actual publish run (workflow_dispatch or a real chart-path push), or only reviewed statically? The working-directory issue would surface immediately on any real run.

Automated triage by Rosetta agent