From ff9469ac7d206590962295afac7c8feede1e609b Mon Sep 17 00:00:00 2001
From: Jordan Simonovski <jordan.simonovski@clickhouse.com>
Date: Fri, 6 Nov 2026 09:42:15 +1100
Subject: [PATCH 1/2] ci: publish released charts to GHCR as OCI artifacts

---
 .github/workflows/release.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 30ef30e..7691502 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,7 @@ concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:
   contents: write
+  packages: write
   pull-requests: write
 jobs:
   release:
@@ -59,3 +60,24 @@ jobs:
           config: .github/cr.yaml
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Push charts to GHCR
+        if: steps.changesets.outputs.hasChangesets == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OCI_REPO: oci://ghcr.io/clickhouse/clickstack-helm-charts
+        run: |
+          echo "$GH_TOKEN" | helm registry login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+          pkgs=$(mktemp -d)
+          # Push the GitHub release asset, not a fresh package, so GHCR serves the same bytes as the Pages repo.
+          for chart in charts/*/Chart.yaml; do
+            read -r name version < <(yq '.name + " " + .version' "$chart")
+            tag="$name-$version"
+            if ! gh release view "$tag" >/dev/null 2>&1; then
+              echo "$tag has no GitHub release, skipping"
+            elif helm show chart "$OCI_REPO/$name" --version "$version" >/dev/null 2>&1; then
+              echo "$tag already in $OCI_REPO, skipping"
+            else
+              gh release download "$tag" -p "$tag.tgz" -D "$pkgs"
+              helm push "$pkgs/$tag.tgz" "$OCI_REPO"
+            fi
+          done

From 95e871c46dd7e676a411fc35fc211e536ae624c3 Mon Sep 17 00:00:00 2001
From: Jordan Simonovski <jordan.simonovski@clickhouse.com>
Date: Fri, 6 Nov 2026 09:47:11 +1100
Subject: [PATCH 2/2] ci: publish OCI charts under ghcr.io/clickhouse/charts

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7691502..fbf2ebb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,7 +64,7 @@ jobs:
         if: steps.changesets.outputs.hasChangesets == 'false'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OCI_REPO: oci://ghcr.io/clickhouse/clickstack-helm-charts
+          OCI_REPO: oci://ghcr.io/clickhouse/charts
         run: |
           echo "$GH_TOKEN" | helm registry login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
           pkgs=$(mktemp -d)