Fix release workflow for ae installer

[senithkay]

Purpose

Describe the problems, issues, or needs driving this feature/fix and include links to related issues in the following format: Resolves issue1, issue2, etc.

Goals

Describe the solutions that this feature/fix will introduce to resolve the problems described above

Approach

Describe how you are implementing the solutions. Include an animated GIF or screenshot if the change affects the UI (email documentation@wso2.com to review all UI text). Include a link to a Markdown file or Google doc if the feature write-up is too long to paste here.

User stories

Summary of user stories addressed by this change>

Release note

Brief description of the new feature or bug fix as it will appear in the release notes

Documentation

Link(s) to product documentation that addresses the changes of this PR. If no doc impact, enter �N/A� plus brief explanation of why there�s no doc impact

Training

Link to the PR for changes to the training content in https://github.com/wso2/WSO2-Training, if applicable

Certification

Type �Sent� when you have provided new/updated certification questions, plus four answers for each question (correct answer highlighted in bold), based on this change. Certification questions/answers should be sent to certification@wso2.com and NOT pasted in this PR. If there is no impact on certification exams, type �N/A� and explain why.

Marketing

Link to drafts of marketing content that will describe and promote this feature, including product page changes, technical articles, blog posts, videos, etc., if applicable

Automation tests

• Unit tests

  Code coverage information

• Integration tests

  Details about the test cases and coverage

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes/no
• Ran FindSecurityBugs plugin and verified report? yes/no
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes/no

Samples

Provide high-level details about the samples related to this feature

Related PRs

List any other related PRs

Migrations (if applicable)

Describe migration steps and platforms on which migration has been tested

Test environment

List all JDK versions, operating systems, databases, and browser/versions on which this feature/fix was tested

Learning

Describe the research phase and any blog posts, patterns, libraries, or add-ons you used to solve the problem.

[coderabbitai]

📝 Walkthrough

Updated the release workflow to support the ae installer end to end.

• Added version replacement coverage for the wso2-ae-installer Helm chart and installer image tag during release version updates.
• Expanded image build workflow triggers so changes under the ae installer directories run CI.
• Added a new build job for the ae installer image targeting multiple architectures.
• Extended the release workflow to build and publish the wso2-ae-installer container image and package/push its Helm chart artifact.

Walkthrough

This pull request adds support for building and releasing a new ae-installer component. The update-versions.sh script now updates version and image tag placeholders in the wso2-ae-installer Helm chart. The build-images.yml workflow adds path triggers for the installer and chart directories and introduces a new build-only ae-installer job for multi-arch Docker images. The release.yml workflow extends its build matrix with the ae-installer image and adds a step to package and push the wso2-ae-installer Helm chart to GHCR.

Changes

Area	Change
Version script	Adds wso2-ae-installer Chart.yaml and values.yaml to version/tag placeholder replacement
Build workflow	Adds new path triggers and a build-only ae-installer multi-arch Docker build job
Release workflow	Adds ae-installer to the image build matrix; adds chart packaging/push step for wso2-ae-installer

Sequence Diagram(s)

sequenceDiagram
  participant Release as release.yml
  participant Docker as build-images job
  participant Helm as publish-chart job
  participant GHCR as GHCR Registry
  Release->>Docker: build ae-installer image from Dockerfile
  Docker->>GHCR: push ae-installer image
  Release->>Helm: package wso2-ae-installer chart
  Helm->>GHCR: push wso2-ae-installer-*.tgz

Loading

Related Issues: None specified.

Related PRs: None specified.

Suggested labels: ci, release, helm-charts

Suggested reviewers: None specified.

Poem
A rabbit hops through YAML trails,
New installer builds set sail,
Charts get packed and versions bumped,
Tags rewritten, workflows plumped,
Ae-installer joins the release parade. 🐇📦

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is only the template text and lacks the required PR details, goals, testing, and links.	Fill in each template section with the actual purpose, goals, approach, testing, documentation, and other required PR details.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately reflects the main change to the ae installer release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/build-images.yml (1)

75-91: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Checkout does not disable credential persistence.

The new ae-installer job's checkout step doesn't set persist-credentials: false, matching the flag raised by static analysis. Same pattern exists in the asdlc-console job above, but since it's a build-only job with no need to push, disabling persistence reduces unnecessary credential exposure on the runner.

🔒 Proposed fix

       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-images.yml around lines 75 - 91, The checkout step
in the ae-installer job is persisting Git credentials unnecessarily. Update the
actions/checkout step in this job to explicitly disable credential persistence
with persist-credentials set to false, matching the safe pattern used elsewhere
in the workflow and keeping the build-only job from retaining push-capable
credentials on the runner.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/build-images.yml:
- Around line 75-91: The checkout step in the ae-installer job is persisting Git
credentials unnecessarily. Update the actions/checkout step in this job to
explicitly disable credential persistence with persist-credentials set to false,
matching the safe pattern used elsewhere in the workflow and keeping the
build-only job from retaining push-capable credentials on the runner.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c0a4d173-bd22-4a22-a415-42647ad4e179

📥 Commits

Reviewing files that changed from the base of the PR and between d23815e and aceb464.

📒 Files selected for processing (3)

• .github/scripts/update-versions.sh
• .github/workflows/build-images.yml
• .github/workflows/release.yml