ci: publish charts through the shared block in workflow-util/pipelines

The reusable publish workflow now lives in workflow-util/pipelines and is
called pinned to @v3. All 25 thin hulls switch over and our copy is deleted in
the same commit: a hull pointing at a deleted file, or an orphaned file nobody
calls, would both be worse than the state before.

Each hull gains one line, registry-owner: ${{ github.repository_owner }}. The
owner used to be derived inside the workflow (#63); as a required input without
a default it is evaluated here, in the calling repository, where the value is
measured. That is the house rule of pipelines - a shared block never guesses an
owner segment - and it keeps the block free of any context semantics. The
workflow_dispatch and push triggers of every hull are untouched; after the move
the dispatch is the only way to trigger a publish by hand.

The Connect host is no longer wired into the block. It reads the repository
variable OP_CONNECT_HOST, which the maintainer has set, and fails in its first
step naming the variable when it is empty.

Documentation follows the same split as the code. The README entry no longer
describes a workflow of this repository; it names where the block lives, what
each caller owes it, and points at the publish-helm-chart page of that
repository's wiki for the reasons behind the upload step, which are no longer
ours to keep current. Nothing of them was lost in the move - the upload step's
shell body went across unchanged apart from two error messages that name the
owner as an input.

Also corrected, because the move made them wrong rather than merely stale:

- the helm-dependencies.sh entry still counted the local publish workflow among
  the five places it runs; it is still five, one of them now the shared block,
  which is why that block names the script as a prerequisite of its callers;
- two comments in install-test.yml pointed at publish-helm-chart.yml as a
  sibling file, one of them for a trap it documented "at length" - that long
  form is now on the pipelines wiki, and the comments say so;
- the hull count read 24, and reusable workflows with secrets: inherit are now
  confirmed to work across repositories too;
- the chart-creation step in CLAUDE.md said the reusable workflow is ours.

install-test.yml stays here, with the reason written down (decision 4 on the
issue): it is reusable in form but welded to the ci/ fixtures, the exclusion
parser and this repository's chart matrix. A block only one repository can use
is not shared, only moved. The note is there so the question is not asked again.

Fixes #66

.github/workflows/install-test.yml

@@ -30,9 +30,10 @@ on:
       OP_CONNECT_TOKEN:
         # Needed by exactly one leg - freesailarr, for the 1Password Connect
         # lookup of its CI Wireguard key. Declared OPTIONAL on purpose, where
-        # publish-helm-chart.yml declares its token required: on this instance a
-        # missing secret does not fail the job, it fails job CREATION, so the
-        # run shows no steps at all (README, "Where this repo lives"). With
+        # the shared publish block in workflow-util/pipelines declares its token
+        # required: on this instance a missing secret does not fail the job, it
+        # fails job CREATION, so the run shows no steps at all (README, "Where
+        # this repo lives"; the long form is on that repository's wiki). With
         # required: true a pull request from a fork - which carries no secrets -
         # would lose the entire install-test that way, every chart at once, with
         # nothing naming the cause. Optional instead: only the freesailarr leg
@@ -196,8 +197,8 @@ jobs:
       # freesailarr is the one chart whose install-test needs credentials:
       # without a real Wireguard key gluetun never completes a handshake, and
       # behind its kill switch not a single app container becomes Ready. The key
-      # comes from 1Password Connect like the registry credentials in
-      # publish-helm-chart.yml, and it is a CI-ONLY Mullvad key: Mullvad ties an
+      # comes from 1Password Connect like the registry credentials in the shared
+      # publish block, and it is a CI-ONLY Mullvad key: Mullvad ties an
       # address to a key and sends the tunnel to the endpoint it saw last, so
       # reusing the production key would let every PR run pull the tunnel out
       # from under the running stack - with the symptom in the cluster and the
@@ -216,7 +217,9 @@ jobs:
           OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
           FREESAILARR_WG_KEY: op://GitHub-Actions/freesailarr-mullvad-test-config/credential
           FREESAILARR_WG_ADDRESSES: op://GitHub-Actions/freesailarr-mullvad-test-config/ip-address
-      # The same trap publish-helm-chart.yml documents at length: v5 of
+      # The same trap the shared publish block documents at length - since
+      # Gitea #66 that long form lives on the wiki of workflow-util/pipelines,
+      # page "publish-helm-chart", not in this repository: v5 of
       # load-secrets-action does NOT export the loaded values as environment
       # variables for later steps, only its step outputs carry them, and the
       # loading step logs "Populating variable" and stays green either way. So

.github/workflows/publish-apache-tika.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-apache-tika:
     name: Publish Apache Tika Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'apache-tika'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-bentopdf.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-bentopdf:
     name: Publish BentoPDF Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'bentopdf'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-calibre-web-automated.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-calibre-web-automated:
     name: Publish Calibre Web Automated Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'calibre-web-automated'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-cyberchef.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-cyberchef:
     name: Publish Cyberchef Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'cyberchef'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-freesailarr.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-freesailarr:
     name: Publish Freesailarr Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'freesailarr'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-gotenberg.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-gotenberg:
     name: Publish Gotenberg Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'gotenberg'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-helm-chart.yml

@@ -1,199 +0,0 @@
-name: Publish Helm Chart with patched Application Version
-on:
-  workflow_dispatch:
-    inputs:
-      chart-location:
-        required: false
-        type: string
-        default: "."
-        description: "location of the helm chart directory"
-      chart-name:
-        required: true
-        type: string
-        description: "name of the helm chart"
-  workflow_call:
-    inputs:
-      chart-location:
-        required: false
-        type: string
-        default: "."
-        description: "location of the helm chart directory"
-      chart-name:
-        required: true
-        type: string
-        description: "name of the helm chart"
-    outputs:
-      chart-version:
-        description: "the version of the published helm chart"
-        value: ${{ jobs.publish-helm-chart.outputs.chart-version }}
-    secrets:
-      OP_CONNECT_TOKEN:
-        required: true
-jobs:
-  publish-helm-chart:
-    outputs:
-      chart-version: ${{ steps.get-chart-version.outputs.CHART_VERSION }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout Repository"
-        uses: actions/checkout@v7
-      - name: "Install Helm"
-        uses: azure/setup-helm@v5
-      - name: "Configure OP-Connect"
-        uses: 1password/load-secrets-action/configure@v5
-        with:
-          connect-host: https://op-connect.jk-dev.de
-      # helm package exits 1 with "found in Chart.yaml, but missing in charts/
-      # directory" while a declared dependency has not been fetched, so this
-      # comes first. It is a no-op for every chart without a dependencies:
-      # block; ci/helm-dependencies.sh explains why it resolves from Chart.yaml
-      # instead of a committed Chart.lock. Note the consequence for the
-      # published artifact: the subchart .tgz is packaged INTO ours, so the
-      # version pinned in Chart.yaml is the version operators get, and nothing
-      # downstream ever sees the dependency again.
-      - name: "Fetch chart dependencies"
-        run: ${{ github.workspace }}/ci/helm-dependencies.sh "${{ inputs.chart-name }}"
-        working-directory: ${{ inputs.chart-location }}
-      - name: "Package Helm Chart"
-        run: helm package ${{ inputs.chart-name }}
-        working-directory: ${{ inputs.chart-location }}
-      - name: "Get Helm Chart Version"
-        id: get-chart-version
-        run: |-
-          CHART_VERSION=$(grep '^version:' ${{ inputs.chart-name}}/Chart.yaml | awk '{print $2}')
-          echo $CHART_VERSION
-          echo "CHART_VERSION=$CHART_VERSION" >> $GITHUB_OUTPUT
-        working-directory: ${{ inputs.chart-location }}
-      - name: "Load Chart Registry Credentials"
-        id: load-registry-creds
-        uses: 1password/load-secrets-action@v5
-        env:
-          OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
-          REGISTRY_PASSWORD: op://GitHub-Actions/jlab-registry-access/password
-          REGISTRY_USERNAME: op://GitHub-Actions/jlab-registry-access/username
-          REGISTRY_CHARTS_URL: op://GitHub-Actions/jlab-registry-access/charts-url
-      # The target is a classic, index-based Helm registry, not an OCI one, so
-      # there is no "helm registry login" session and no "helm push": the upload
-      # is a single HTTP POST of the packaged .tgz to
-      # <charts-url>/<owner>/helm/api/charts, authenticated per request.
-      #
-      # That URL is composed, not stored (#63). charts-url holds only the base
-      # up to "/api/packages"; the owner segment comes from
-      # github.repository_owner - which Gitea does populate: measured as
-      # "jlab-cluster" in run 282 of validate-charts.yml, on a temporary step
-      # that was removed again. So no value pointing at the registry - not even
-      # a path segment - lives in this repository, and a second owner on the same
-      # instance needs no second setting. The mirror on github.com has Actions
-      # switched off, so the publish never runs there; if it ever did, the
-      # derived owner would be one the instance does not know and the upload
-      # would 404 rather than land somewhere wrong. Two guards make the switch
-      # from the old shape loud instead of puzzling: charts-url is rejected
-      # unless it ends in "/api/packages" (an old full URL still carrying
-      # "/helm", "/api/charts" or the owner is named explicitly), and the derived
-      # owner is rejected when empty or when it holds characters that are not a
-      # path segment - an empty one would build "<base>//helm/api/charts", i.e.
-      # another bare 404 against a masked URL.
-      #
-      # Three further properties of this step are load-bearing and each of them
-      # was paid for once already.
-      #
-      # 1) The values are mapped into the step's own env block and read as quoted
-      # shell variables - never interpolated into the command line. load-secrets-
-      # action v5 (bumped in #140) no longer exports the loaded values as
-      # environment variables for later steps the way v4 did; only the step
-      # outputs carry them. Every "${{ env.* }}" reference therefore resolved to
-      # an empty string from that bump on, with nothing reporting an error - the
-      # loading step logs "Populating variable" and stays green either way. The
-      # ":?" guards fail loudly and name the op:// field that is missing, and
-      # quoting keeps an empty value from silently shifting arguments.
-      #
-      # 2) The credentials never reach the process list. "curl --user $U:$P"
-      # would put them in argv; "curl --config -" reads its options from stdin
-      # instead, so nothing sensitive appears in any argument. The price of that
-      # config file is its value syntax: an unquoted value ends at the first
-      # space (measured on curl 8.5.0 - "has space" arrived as "has"), so the
-      # step refuses whitespace in the credentials up front rather than letting
-      # a truncated password come back as a puzzling 401. A Gitea access token
-      # is 40 hex characters, so this only ever fires on a mis-entered item.
-      #
-      # 3) "--fail-with-body" is what makes a failed upload fail the job. Unlike
-      # "helm push", curl exits 0 on HTTP 401/403/409 unless asked not to - the
-      # publish would go green while nothing was uploaded. Measured against Gitea
-      # 1.24.7: a 401 without the flag is exit 0, with the flag exit 22, and the
-      # response body is still printed so the log names the cause.
-      #
-      # The file name is built from the chart name and the version read above
-      # instead of a "<chart>-*.tgz" glob: --upload-file takes exactly one file,
-      # and a glob matching two turns the second into curl's URL argument, while
-      # a glob matching none is passed through literally. Both fail obscurely.
-      # "helm package" keeps the "+" of a "1.4.0+up1.9.2" version verbatim in the
-      # file name, so "<name>-<version>.tgz" is an exact match (measured).
-      - name: "Upload Helm Chart to the Chart Registry"
-        env:
-          REGISTRY_PASSWORD: ${{ steps.load-registry-creds.outputs.REGISTRY_PASSWORD }}
-          REGISTRY_USERNAME: ${{ steps.load-registry-creds.outputs.REGISTRY_USERNAME }}
-          REGISTRY_CHARTS_URL: ${{ steps.load-registry-creds.outputs.REGISTRY_CHARTS_URL }}
-          REGISTRY_OWNER: ${{ github.repository_owner }}
-          CHART_NAME: ${{ inputs.chart-name }}
-          CHART_VERSION: ${{ steps.get-chart-version.outputs.CHART_VERSION }}
-        run: |-
-          : "${REGISTRY_CHARTS_URL:?empty - check op://GitHub-Actions/jlab-registry-access/charts-url}"
-          : "${REGISTRY_USERNAME:?empty - check op://GitHub-Actions/jlab-registry-access/username}"
-          : "${REGISTRY_PASSWORD:?empty - check op://GitHub-Actions/jlab-registry-access/password}"
-          : "${REGISTRY_OWNER:?empty - github.repository_owner is not populated on this forge; do not hardcode an owner, report it}"
-          : "${CHART_NAME:?empty - the chart-name input did not arrive}"
-          : "${CHART_VERSION:?empty - could not read version: from ${CHART_NAME}/Chart.yaml}"
-          # 1Password masks the full URL, but a curl connection error prints only
-          # "<host>:<port>", which that mask would not cover. Mask the host too.
-          CHARTS_HOST="${REGISTRY_CHARTS_URL#*://}"
-          echo "::add-mask::${CHARTS_HOST%%/*}"
-          # charts-url is the base only; this workflow appends the owner, the
-          # package type and the endpoint. Reject the old, full shape by name so
-          # the failure says what to change in the vault item instead of 404ing
-          # against a URL the log has masked.
-          CHARTS_BASE="${REGISTRY_CHARTS_URL%/}"
-          case "$CHARTS_BASE" in
-            */api/charts)
-              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url still ends in /api/charts - it must hold only the base up to /api/packages (https://<host>/api/packages); this workflow appends /<owner>/helm/api/charts itself"
-              exit 1
-              ;;
-            */helm|*/helm/*)
-              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url still contains the /helm path segment - it must hold only the base up to /api/packages (https://<host>/api/packages); this workflow appends /<owner>/helm/api/charts itself"
-              exit 1
-              ;;
-            */api/packages) ;;
-            *)
-              echo "::error::op://GitHub-Actions/jlab-registry-access/charts-url must end in /api/packages (https://<host>/api/packages) - no owner, no package type, no endpoint; this workflow appends /<owner>/helm/api/charts itself"
-              exit 1
-              ;;
-          esac
-          # An empty owner would build "<base>//helm/api/charts", a stray "/" or
-          # "?" would build something else entirely - both are bare 404s.
-          case "$REGISTRY_OWNER" in
-            *[!A-Za-z0-9._-]*)
-              echo "::error::the derived repository owner is not usable as a URL path segment: '${REGISTRY_OWNER}'"
-              exit 1
-              ;;
-          esac
-          CHARTS_API_URL="${CHARTS_BASE}/${REGISTRY_OWNER}/helm/api/charts"
-          case "${REGISTRY_USERNAME}${REGISTRY_PASSWORD}" in
-            *[[:space:]]*)
-              echo "::error::username/password in op://GitHub-Actions/jlab-registry-access must not contain whitespace - curl --config truncates an unquoted value at the first space"
-              exit 1
-              ;;
-          esac
-          CHART_PACKAGE="${CHART_NAME}-${CHART_VERSION}.tgz"
-          test -f "$CHART_PACKAGE" || {
-            echo "::error::${CHART_PACKAGE} does not exist - helm package produced: $(ls -1 ./*.tgz 2>&1)"
-            exit 1
-          }
-          echo "uploading ${CHART_PACKAGE}"
-          printf 'user = %s:%s\nurl = %s\n' \
-            "$REGISTRY_USERNAME" "$REGISTRY_PASSWORD" "$CHARTS_API_URL" |
-            curl --config - \
-                 --fail-with-body \
-                 --silent --show-error \
-                 --request POST \
-                 --upload-file "$CHART_PACKAGE" \
-                 --write-out '\nHTTP %{http_code}\n'
-        working-directory: ${{ inputs.chart-location }}

.github/workflows/publish-homeassistant.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-homeassistant:
     name: Publish Homeassistant Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'homeassistant'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-matrix-synapse.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-matrix-synapse:
     name: Publish Matrix Synapse Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'matrix-synapse'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-minecraft-router.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-minecraft-router:
     name: Publish Minecraft-Router Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'minecraft-router'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-minecraft-server.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-minecraft-server:
     name: Publish Minecraft-Server Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'minecraft-server'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-outline.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-outline:
     name: Publish Outline Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'outline'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-paperless-ngx.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-paperless-ngx:
     name: Publish Paperless-NGX Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'paperless-ngx'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-patchmon.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-patchmon:
     name: Publish Patchmon Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'patchmon'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-rallly.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-rallly:
     name: Publish Rallly Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'rallly'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-rss-bridge.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-rss-bridge:
     name: Publish RSS-Bridge Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'rss-bridge'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-samba.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-samba:
     name: Publish Samba Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'samba'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-satisfactory.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-satisfactory:
     name: Publish Satisfactory Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'satisfactory'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-searxng.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-searxng:
     name: Publish SearXNG Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'searxng'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-sure.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-sure:
     name: Publish Sure Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'sure'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-teamspeak-server.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-teamspeak-server:
     name: Publish TeamSpeak Server Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'teamspeak-server'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-urlaubsverwaltung.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-urlaubsverwaltung:
     name: Publish Urlaubsverwaltung Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'urlaubsverwaltung'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-valkey.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-valkey:
     name: Publish Valkey Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'valkey'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-voucher-vault.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-voucher-vault:
     name: Publish VoucherVault Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'voucher-vault'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-ytdlp-web-player.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-ytdlp-web-player:
     name: Publish YTDLP Web Player Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'ytdlp-web-player'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit

.github/workflows/publish-zipline.yml

@@ -9,7 +9,8 @@ on:
 jobs:
   publish-zipline:
     name: Publish Zipline Helm Chart
-    uses: ./.github/workflows/publish-helm-chart.yml
+    uses: workflow-util/pipelines/.gitea/workflows/publish-helm-chart.yml@v3
     with:
       chart-name: 'zipline'
+      registry-owner: ${{ github.repository_owner }}
     secrets: inherit