ci: add fallback for helm install when get.helm.sh is down (#21268)

kacpersaw · web-flow · commit 134924ded082 · 2025-12-16T12:20:35.000+01:00
Add a fallback step that installs helm via apt from Buildkite's repository if the primary `azure/setup-helm` action fails. This makes CI resilient to `get.helm.sh` outages while preserving the caching benefits of the action when it works. ## Changes - Primary: `azure/setup-helm` with `continue-on-error: true` - Fallback: apt install from Buildkite's helm-debian repository (only runs if primary fails) The fallback uses GPG-signed packages from the [official Helm apt repository](https://helm.sh/docs/intro/install/#from-apt-debianubuntu) hosted by Buildkite. ## Background On Oct 29, 2025, `get.helm.sh` experienced an outage that broke CI. A workaround was applied (#20552) but later reverted. This PR makes the workaround automatic - it only kicks in when needed. Fixes: coder/internal#1109
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -207,6 +207,22 @@ jobs:
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
         with:
           version: v3.9.2
+        continue-on-error: true
+        id: setup-helm
+
+      - name: Install helm (fallback)
+        if: steps.setup-helm.outcome == 'failure'
+        # Fallback to Buildkite's apt repository if get.helm.sh is down.
+        # See: https://github.com/coder/internal/issues/1109
+        run: |
+          set -euo pipefail
+          curl -fsSL https://packages.buildkite.com/helm-linux/helm-debian/gpgkey | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null
+          echo "deb [signed-by=/usr/share/keyrings/helm.gpg] https://packages.buildkite.com/helm-linux/helm-debian/any/ any main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
+          sudo apt-get update
+          sudo apt-get install -y helm=3.9.2-1
+
+      - name: Verify helm version
+        run: helm version --short
 
       - name: make lint
         run: |
