[bsinou]

publish-chart.sh promises that a version already in the registry is never overwritten. It was overwritten every time.

Cause

The presence check runs helm pull "$repository" --version "$version" -d "$work/existing", and nothing creates $work/existing. helm pull does not create its destination directory: it prints the digest, then fails with open …/existing/<chart>-<version>.tgz…: no such file or directory. Every failure of that pull was taken for "absent", so the script went on and pushed. The same code is in v0.1.0, on dev, on feat/wpb-29305-publish-extra-chart and on feat/wpb-29305-retry-safe-publication (#6, which also pulls into $work/readback).

The tests did not see it: the fake helm ran mkdir -p on the destination itself.

Evidence

quay.io/wire/charts/stable/step-certificates:1.29.3-alpha.2 (wireapp/helm-charts, run 43257391868), tag history on Quay:

Digest	From (UTC, 2026-11-12)	Pushed by
d308cdf…	18:18:39	the release run, attempt 2 (the digest in the GitHub release manifest)
b66b72f…	18:23:07	the rerun of the publish job, attempt 3 (status=pushed)
0d92ab5…	18:28:27	a local run of the unfixed script while checking this fix

The digests differ because helm dependency update writes a new generated: date in Chart.lock at every run. Reproduced locally with Helm: the pull fails without the directory and succeeds with it.

Change

• mkdir -p "$work/existing" before the first pull.
• A pull that fails is "absent" only when helm says so (not found, manifest unknown, name unknown, 401/403/404, unauthorized, denied). Any other failure (a local error, the network, a 5xx) stops the script with the pull output instead of pushing. A missing repository answers 401 to the pull, and a push without access fails the same way, so it overwrites nothing.
• The fake helm of the tests no longer creates the directory and refuses a missing one like helm does; FAKE_PULL_ERROR makes the pull fail with a given message.

Checks

• With the stricter fake and the old script, the 6 tests that guard "never overwritten" fail; with the fix, tests/test_publish_chart.py passes (40, 6 new: 3 pull errors that stop the script in both modes, 3 answers that mean absent).
• Run with the real Helm against Quay: the fixed script answers already published, not overwritten, status=present, digest of the current tag.
• shellcheck, actionlint, zizmor --offline clean.

Follow-ups

• Same fix on feat/wpb-29305-publish-extra-chart, which wireapp/helm-charts calls by branch, and on feat: retry-safe publication, wire-builds-bump, repair template - WPB-29305 #6 ($work/readback).
• 1.29.3-alpha.2 has to be restored to d308cdf… on Quay.