From 508793be7392690dc8aebbfd0970433d9964ba6b Mon Sep 17 00:00:00 2001
From: John T Skarbek <john.skarbek@coder.com>
Date: Fri, 16 Oct 2026 10:57:30 -0400
Subject: [PATCH] ci: open a pull request that syncs the chart version after a
 release

make lint sets Chart.yaml and the README install command from the latest
stable tag, and fails if they changed. A tag cannot contain its own
version, so main fails lint after every release until someone commits
the sync.

Add a sync-version job to the publish-helm workflow. It runs after the
release job succeeds, runs make readme on main, and opens a pull request
with the result. It does nothing when the files already match, for
example after a prerelease tag.

Remove the two TODO comments in the Makefile that this replaces.
---
 .github/workflows/release.yaml | 60 ++++++++++++++++++++++++++++++++++
 Makefile                       |  7 ++--
 2 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c2dccaf..b5fad2d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -58,3 +58,63 @@ jobs:
         if: ${{ !inputs.dry_run }}
         run: |
           ./scripts/publish.sh
+
+  # The chart version in Chart.yaml and the README comes from the latest stable
+  # tag. A tag cannot contain its own version, so open a pull request that
+  # commits it. Without this, `make lint` fails on main after every release.
+  sync-version:
+    name: Sync chart version
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Fetch git tags
+        run: git fetch --tags --force
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.23
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.17.1
+
+      - name: Install yq
+        run: |
+          sudo wget https://github.com/mikefarah/yq/releases/download/v4.42.1/yq_linux_amd64 -O /usr/bin/yq &&\
+          sudo chmod +x /usr/bin/yq
+
+      - name: Sync Chart.yaml and README
+        run: make readme
+
+      # Does nothing when the files already match, for example after a
+      # prerelease tag.
+      - name: Open pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          base: main
+          branch: chore/sync-chart-version
+          delete-branch: true
+          add-paths: |
+            coder-observability/Chart.yaml
+            README.md
+          commit-message: "chore: sync chart version and README with ${{ github.ref_name }}"
+          title: "chore: sync chart version and README with ${{ github.ref_name }}"
+          body: |
+            Automated by the `publish-helm` workflow after the `${{ github.ref_name }}` release.
+
+            `make lint` sets `Chart.yaml` and the README install command from the latest stable tag. A tag cannot contain its own version, so this pull request commits it.
+
+            The files come from `make readme`. Nothing else changes.
+
+            Pull requests that GitHub Actions opens do not start other workflows. To run the `lint` check, close this pull request and open it again.
diff --git a/Makefile b/Makefile
index 9b5b83a..7751988 100644
--- a/Makefile
+++ b/Makefile
@@ -37,8 +37,8 @@ lint/helm/prometheus-rules:
 
 .PHONY: lint/helm/prometheus-rules
 
-# Set coder-observability/Chart.yaml version to the latest stable git tag
-# TODO: auto-update chart version in Chart.yaml when a new release is published
+# Set coder-observability/Chart.yaml version to the latest stable git tag.
+# The release workflow runs this after a release and opens a pull request.
 chart/version-sync:
 	version=$(shell ./scripts/version.sh -s) && \
 	if [ -z "$$version" ]; then \
@@ -55,7 +55,8 @@ publish-%:
 	git tag --sign "$$version" -m "Release: $$version" && \
 	git push origin tag "$$version"
 
-# TODO: auto-update chart version in README files when a new release is published
+# Regenerate the README, including the install command version.
+# The release workflow runs this after a release and opens a pull request.
 readme: chart/version-sync
 	go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
 	helm-docs --output-file ../README.md \