Smoke test and PR

[ksuderman]

This PR adds two new jobs to the build_container_image.yaml workflow.

1. smoke-test installs the newly built image to a k8s cluster and then calls /api/version
2. pr opens a PR to the Galaxy Helm chart repository to update the version. Only triggered when a release is tagged

Outstanding issues

• ensure the GITHUB_TOKEN used to create a PR in the Galaxy Helm repository has permission.
• updating the version with sed to generate the PR is fragile

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[ksuderman]

I have tested the smoke-test and pr jobs in a separate repository and this "should work" ™️. However, as I suspected the standard secrets.GITHUB_TOKEN is scoped to the current repository and doesn't have permission to open a pull request in a different repository. A separate token (PAT or similar) will need to be created (I've called it secrets.PULL_REQUEST_TOKEN here) before this PR can be accepted.

[nuwang]

Thanks for this, looks great to me! Let me know when it's ready for testing.

[ksuderman]

Thanks for this, looks great to me! Let me know when it's ready for testing.

I think this is ready for testing. At least I think I've done all the testing that I can as is. Do you have suggestions for testing beyond releasing this into the wild and see how it does?

[nuwang]

I think this is ready for testing. At least I think I've done all the testing that I can as is. Do you have suggestions for testing beyond releasing this into the wild and see how it does?

I should have said - can it be taken out of review? I agree with what you said about testing

[ksuderman]

I was going to take it out of Draft once we had the token set up. Maybe @afgane can do that?

[nuwang]

I've added the token @ksuderman. It only has PR read-write permissions on the galaxy-helm repo. Let me know if it needs more perms than that.

[ksuderman]

That should be enough. I guess we will find out when it attempts to create a PR.

[nsoranzo]

@ksuderman I'm reviewing our use of persist-credentials and I think it should be set to false here, as you are using a different token when creating the pull request?
Also the token line can be removed.

[nsoranzo]

#21705