ci: orchestrate verified operator releases

.github/workflows/chart-release.yml

@@ -16,6 +16,16 @@ on:
         required: false
         default: false
         type: boolean
+      operator_image:
+        description: Optional immutable operator image used by lifecycle tests
+        required: false
+        default: ""
+        type: string
+      operator_index_digest:
+        description: Expected operator OCI index digest for the lifecycle pod
+        required: false
+        default: ""
+        type: string
   workflow_dispatch:
     inputs:
       operator_version:
@@ -62,13 +72,14 @@ jobs:
       - name: Upload candidate artifact
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
-          name: helm-chart-${{ inputs.chart_version }}
+          name: helm-chart-${{ inputs.chart_version }}-${{ github.run_id }}
           path: |
             dist/chart/webhookrelay-operator-${{ inputs.chart_version }}.tgz
             dist/chart/webhookrelay-operator-${{ inputs.chart_version }}.tgz.sha256
             dist/chart/release-metadata.json
           if-no-files-found: error
           retention-days: 14
+          overwrite: true
 
   lifecycle:
     name: Test exact chart artifact in k3s
@@ -87,12 +98,14 @@ jobs:
       - name: Download validated artifact
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
-          name: helm-chart-${{ inputs.chart_version }}
+          name: helm-chart-${{ inputs.chart_version }}-${{ github.run_id }}
           path: validated
 
       - name: Run packaged chart lifecycle
         env:
           WHR_E2E_CANDIDATE_CHART: ${{ github.workspace }}/validated/webhookrelay-operator-${{ inputs.chart_version }}.tgz
+          WHR_E2E_OPERATOR_IMAGE: ${{ inputs.operator_image }}
+          WHR_E2E_OPERATOR_INDEX_DIGEST: ${{ inputs.operator_index_digest }}
         run: make e2e
 
       - name: Upload failure diagnostics
@@ -121,7 +134,7 @@ jobs:
       - name: Download validated artifact
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
-          name: helm-chart-${{ inputs.chart_version }}
+          name: helm-chart-${{ inputs.chart_version }}-${{ github.run_id }}
           path: validated
 
       - name: Set up Go

.github/workflows/ci.yml

@@ -54,6 +54,9 @@ jobs:
           make chart-package HELM_BIN=.test/helm
           make chart-release-check HELM_BIN=.test/helm
           make chart-release-test HELM_BIN=.test/helm
+          make release-workflow-test
+          .test/helm template webhookrelay-operator charts/webhookrelay-operator \
+            --set-string image.digest=sha256:test | grep -Fq 'webhookrelay/webhookrelay-operator@sha256:test'
 
   e2e:
     name: End-to-End and Helm Lifecycle (k3s)

.github/workflows/production-e2e.yml

@@ -1,6 +1,25 @@
 name: Production End-to-End Validation
 
 on:
+  workflow_call:
+    inputs:
+      operator_image:
+        description: Immutable operator image reference to validate
+        required: true
+        type: string
+      agent_image:
+        description: Relay-agent image to validate
+        required: true
+        type: string
+      operator_index_digest:
+        description: Expected operator OCI index digest
+        required: true
+        type: string
+    secrets:
+      WHR_E2E_RELAY_KEY:
+        required: true
+      WHR_E2E_RELAY_SECRET:
+        required: true
   workflow_dispatch:
     inputs:
       confirmation:
@@ -12,16 +31,26 @@ on:
         required: false
         default: webhookrelay/webhookrelayd-ubi8:1.37.0
         type: string
+      operator_image:
+        description: Published operator image to validate; blank builds the checkout
+        required: false
+        default: ""
+        type: string
+      operator_index_digest:
+        description: Optional expected operator OCI index digest
+        required: false
+        default: ""
+        type: string
 
 permissions:
   contents: read
 
 jobs:
   production-e2e:
     name: Production Live Delivery (k3s)
-    if: inputs.confirmation == 'production'
+    if: github.event_name == 'workflow_call' || inputs.confirmation == 'production'
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 22
     environment: production
     env:
       WHR_OPERATOR_E2E_PRODUCTION: "true"
@@ -30,13 +59,20 @@ jobs:
       WHR_E2E_RELAY_SECRET: ${{ secrets.WHR_E2E_RELAY_SECRET }}
       WHR_E2E_FUNCTION_ID: ${{ vars.WHR_E2E_FUNCTION_ID }}
       WHR_E2E_AGENT_IMAGE: ${{ inputs.agent_image }}
+      WHR_E2E_OPERATOR_IMAGE: ${{ inputs.operator_image }}
+      WHR_E2E_OPERATOR_INDEX_DIGEST: ${{ inputs.operator_index_digest }}
     steps:
       - name: Checkout code
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Validate production reconciliation and live delivery
+        timeout-minutes: 17
         run: make e2e
 
+      - name: Verify exact cleanup after failure or cancellation
+        if: always()
+        run: ./.test/cleanup-production.sh
+
       - name: Upload failure diagnostics
         if: failure() || cancelled()
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5