chore(release): appwrite 1.0.0

[levivannoort]

What

Cuts 1.0.0, the first release of the chart, for Appwrite 2.3.0. Nothing has been published before, so the SemVer promise starts here.

• CHANGELOG.md: the entries move to [1.0.0], rewritten as a summary of what the first release ships (11 entries) rather than the history of unreleased changes.
• Chart.yaml: version: 1.0.0, artifacthub.io/prerelease: "false", and artifacthub.io/changes regenerated with make changes.
• docs/upgrading.md, docs/gitops.md: name 1.0.0.
• RELEASING.md: the first-release checklist is for 1.0.0, and the repository must be public before this merges.
• tests/scheduling_test.yaml: the chart-label test sets its own chart version, so version bumps don't break it.

Merging publishes the release: OCI push to ghcr.io/appwrite/charts/appwrite, cosign signature, provenance attestation, GitHub release appwrite-1.0.0 and Artifact Hub metadata (see RELEASING.md).

Before merging

GitHub Actions hasn't run since 2026-10-12: while the repository is private, jobs aren't started ("recent account payments have failed or your spending limit needs to be increased"). The release workflow also skips itself on a private repository. So, by an org owner or repository admin:

• Make the repository public (Settings → General → Change visibility). History was scanned with gitleaks: 9 findings, all false positives (RFC 6455's sample WebSocket key, an existing test fixture, a <password> placeholder).
• Check that Actions starts again; if jobs still fail on billing, fix it under the organisation's Billing settings.
• Turn on private vulnerability reporting (Settings → Code security), and secret scanning with push protection.
• Ruleset on main: require a pull request and the Lint and test checks (both Lint jobs, both Unit test jobs, kubeconform, Generated files are up to date, Chart metadata, Artifact Hub lint, Changelog).
• This pull request's checks pass, including Install, and a manual run of Nightly end-to-end (the only run that builds and executes functions).

After merging

• Verify the release:

  helm show chart oci://ghcr.io/appwrite/charts/appwrite --version 1.0.0
  cosign verify ghcr.io/appwrite/charts/appwrite:1.0.0 \
    --certificate-identity https://github.com/appwrite/helm-chart/.github/workflows/release.yaml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
  gh attestation verify oci://ghcr.io/appwrite/charts/appwrite:1.0.0 --repo appwrite/helm-chart

• Org owner: make the charts/appwrite package public and link it to this repository. Until then helm install needs a GHCR login; check with helm registry logout ghcr.io and the helm show chart above.
• Register on Artifact Hub (Helm charts, oci://ghcr.io/appwrite/charts/appwrite), put repositoryID and an owner in artifacthub-repo.yml, and re-run the Release workflow, which then only pushes the metadata.
• Renovate: install the app and set the RENOVATE_HOOK_* secrets (CONTRIBUTING.md, "Renovate pull requests").

Testing

• make test passes locally: ct lint, helm lint --strict on every ci/ scenario, 236/236 unit tests, kubeconform on Kubernetes 1.29–1.37, examples, generated files, check-changes.
• Release rehearsal: helm package, push to a local OCI registry, pull and render from it; the workflow's release-notes extraction produces the [1.0.0] section.
• Not run: the kind installs and the nightly, which wait for Actions.

Checklist

• make test passes locally
• make generate was run and the generated files are committed
• Unit tests added or updated
• Guides in docs/ and files in examples/ updated for changes to how the chart is configured
• CHANGELOG.md and artifacthub.io/changes for the release (this is the release pull request)
• Renamed or removed values go through Deprecating a value (none)

[hansi-codes]

🟢 Tier S · Ready to merge

The release metadata, changelog extraction inputs, documentation references, and updated test expectation are consistent.

This release change versions the chart as 1.0.0 for Appwrite 2.3.0 and records the first-release feature summary in the changelog and Artifact Hub metadata. It updates the release checklist and version references in the guides, and makes the chart-label unit test use an explicit chart version.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 7

File	Change
CHANGELOG.md	Adds the 1.0.0 first-release notes while leaving an empty Unreleased section.
RELEASING.md	Updates the first-release checklist and prerelease guidance for 1.0.0.
charts/appwrite/Chart.yaml	Sets chart version and prerelease metadata, and refreshes Artifact Hub change entries.
charts/appwrite/README.md	Regenerates the chart README version badge.
charts/appwrite/tests/scheduling_test.yaml	Pins the chart version in the chart-label test so the expected label is independent of the release version.
docs/gitops.md	Updates installation examples to target chart version 1.0.0.
docs/upgrading.md	Records the 1.0.0 to Appwrite 2.3.0 mapping and first-release version note.

---

_{Reviewed 124f33c · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary

[levivannoort]

1.0.0 is published and verified (2026-10-14).

• oci://ghcr.io/appwrite/charts/appwrite version 1.0.0, digest sha256:31b5abe698d89d00ae69b13c6241098483d6804cc28a7d6325a0932a3ccbb92a, built from 9543046 (includes chore: update-images script; orchestrator 2.2.3, Redis 7.4.11, ClickHouse 26.4.5 #17).
• Anonymous pull works: the package is public.
• The cosign keyless signature was verified in the workflow with the identity in docs/security.md.
• gh attestation verify: SLSA v1 provenance for that digest, signed by release.yaml@refs/heads/main on a GitHub-hosted runner.
• GitHub release appwrite-1.0.0, marked Latest, with the chart archive attached.
• The Artifact Hub metadata is pushed to :artifacthub.io.

How it went: the first run (38530606243) pushed the chart and then failed on helm pull into a directory that didn't exist (Helm 4), fixed in #20. The re-run (38531223420) reused the published digest and added the rest.

Still to do:

• Register on Artifact Hub (Helm charts, oci://ghcr.io/appwrite/charts/appwrite), then put repositoryID and an owner in artifacthub-repo.yml and re-run Release.
• Private vulnerability reporting, and the ruleset on main.
• Renovate app and the RENOVATE_HOOK_* secrets.
• Deploy gcrunner v0.2.0-appwrite.19 (fork refusal). Until then, the fork-approval gate is what protects the runners.