ci: open a pull request that syncs the chart version after a release

.github/workflows/release.yaml

@@ -58,3 +58,63 @@ jobs:
         if: ${{ !inputs.dry_run }}
         run: |
           ./scripts/publish.sh
+
+  # The chart version in Chart.yaml and the README comes from the latest stable
+  # tag. A tag cannot contain its own version, so open a pull request that
+  # commits it. Without this, `make lint` fails on main after every release.
+  sync-version:
+    name: Sync chart version
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Fetch git tags
+        run: git fetch --tags --force
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.23
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.17.1
+
+      - name: Install yq
+        run: |
+          sudo wget https://github.com/mikefarah/yq/releases/download/v4.42.1/yq_linux_amd64 -O /usr/bin/yq &&\
+          sudo chmod +x /usr/bin/yq
+
+      - name: Sync Chart.yaml and README
+        run: make readme
+
+      # Does nothing when the files already match, for example after a
+      # prerelease tag.
+      - name: Open pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          base: main
+          branch: chore/sync-chart-version
+          delete-branch: true
+          add-paths: |
+            coder-observability/Chart.yaml
+            README.md
+          commit-message: "chore: sync chart version and README with ${{ github.ref_name }}"
+          title: "chore: sync chart version and README with ${{ github.ref_name }}"
+          body: |
+            Automated by the `publish-helm` workflow after the `${{ github.ref_name }}` release.
+
+            `make lint` sets `Chart.yaml` and the README install command from the latest stable tag. A tag cannot contain its own version, so this pull request commits it.
+
+            The files come from `make readme`. Nothing else changes.
+
+            Pull requests that GitHub Actions opens do not start other workflows. To run the `lint` check, close this pull request and open it again.

Makefile

@@ -37,8 +37,8 @@ lint/helm/prometheus-rules:
 
 .PHONY: lint/helm/prometheus-rules
 
-# Set coder-observability/Chart.yaml version to the latest stable git tag
-# TODO: auto-update chart version in Chart.yaml when a new release is published
+# Set coder-observability/Chart.yaml version to the latest stable git tag.
+# The release workflow runs this after a release and opens a pull request.
 chart/version-sync:
 	version=$(shell ./scripts/version.sh -s) && \
 	if [ -z "$$version" ]; then \
@@ -55,7 +55,8 @@ publish-%:
 	git tag --sign "$$version" -m "Release: $$version" && \
 	git push origin tag "$$version"
 
-# TODO: auto-update chart version in README files when a new release is published
+# Regenerate the README, including the install command version.
+# The release workflow runs this after a release and opens a pull request.
 readme: chart/version-sync
 	go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
 	helm-docs --output-file ../README.md \