From b70312498b7e6b17eb1b2d828422b28ec5a2c8f2 Mon Sep 17 00:00:00 2001
From: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>
Date: Tue, 25 Aug 2026 04:32:18 +0530
Subject: [PATCH] fix: Refuse helm chart publish when version already exists

- fail publish when chart version already exists (no silent overwrite)

Fixes #324

Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>
---
 .github/workflows/publish-mcp-helm-chart.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/publish-mcp-helm-chart.yml b/.github/workflows/publish-mcp-helm-chart.yml
index ab7fb901..22b9ad78 100644
--- a/.github/workflows/publish-mcp-helm-chart.yml
+++ b/.github/workflows/publish-mcp-helm-chart.yml
@@ -76,6 +76,16 @@ jobs:
         with:
           version: v3.20.2
 
+      - name: Refuse overwrite of existing chart version
+        run: |
+          set -euo pipefail
+          VER=$(grep -E "^version:" Chart.yaml | head -1 | awk "{print \$2}")
+          echo "Chart version is ${VER}"
+          # Best-effort: if the OCI tag already resolves, abort instead of overwriting.
+          if helm pull oci://ghcr.io/${{ github.repository_owner }}/charts/$(basename $(pwd)) --version "${VER}" --destination /tmp/helm-check 2>/dev/null; then
+            echo "::error::version ${VER} already published"
+            exit 1
+          fi
       - name: Package and push Helm chart (OCI / Docker Hub)
         run: |
           set -euo pipefail