// Upgrades Helm chart dependencies (PostgreSQL, Vault) in the Chainloop project, including vendorized charts, container images, and CI/CD workflows. Use when the user mentions upgrading Helm charts, Bitnami dependencies, PostgreSQL chart, or Vault chart. CRITICAL - Major version upgrades are FORBIDDEN and must be escalated.
Reviews vulnerability policy violations for the chainloop project recorded in Chainloop and performs fixes in Dockerfiles or go.mod. Use when asked to fix vulnerabilities, review CVEs, or remediate security issues in chainloop.
Upgrades Go version across the entire Chainloop codebase including source files, Docker images, CI/CD workflows, and documentation. Use when the user mentions upgrading Go, golang version, or updating Go compiler version.
Reviews open Dependabot pull requests, assesses their risk level based on version bump type and CI status, approves low-risk PRs, and merges them. Use when asked to process, review, merge, or triage Dependabot PRs.
Create a custom builtin function to be used in the Rego policy engine
| name | upgrading-chart |
| description | Upgrades Helm chart dependencies (PostgreSQL, Vault) in the Chainloop project, including vendorized charts, container images, and CI/CD workflows. Use when the user mentions upgrading Helm charts, Bitnami dependencies, PostgreSQL chart, or Vault chart. CRITICAL - Major version upgrades are FORBIDDEN and must be escalated. |
This skill automates the upgrade process for Helm chart dependencies in the Chainloop project. Supports PostgreSQL and Vault (both Bitnami charts).
Version Upgrade Rules:
MANDATORY: If major version upgrade is detected, STOP the process and inform the user that manual review is required.
The skill supports two upgrade types:
IMPORTANT: Container images are ONLY updated as part of chart upgrades, never independently (unless Type 1).
Ask the user which type of upgrade they want:
Also ask which chart: postgresql or vault
Check current state:
cat deployment/chainloop/charts/<chart-name>/Chart.yaml | grep "^version:"
cat deployment/chainloop/charts/<chart-name>/Chart.yaml | grep "^appVersion:"
For any version change, validate that major version remains the same:
CURRENT_MAJOR=$(echo "$CURRENT_VERSION" | cut -d. -f1)
TARGET_MAJOR=$(echo "$TARGET_VERSION" | cut -d. -f1)
if [ "$CURRENT_MAJOR" != "$TARGET_MAJOR" ]; then
echo "FORBIDDEN: Major version upgrade detected"
exit 1
fi
If major version upgrade detected, STOP and escalate.
See image-upgrade-process.md for detailed steps.
Summary:
deployment/charts/<chart-name>/Chart.yaml appVersion.github/workflows/build_external_container_images.yaml commit hashSee chart-upgrade-process.md for detailed steps.
Summary:
After any upgrade type, run:
# Lint charts
helm lint deployment/charts/<chart-name>
helm lint deployment/chainloop
# Template validation
helm template deployment/charts/<chart-name>
helm template deployment/chainloop
# Local testing
cd devel && docker compose up
# Verify image consistency
grep -r "appVersion\|image.*tag" deployment/charts/<chart-name>/
See files-modified.md for complete list.
Common issues:
If issues occur:
git checkout HEAD -- deployment/
find deployment/ -name "Chart.lock" -delete
cd deployment/chainloop && helm dependency build
cd ../../devel && docker compose down && docker compose up