fix(preview): the sticky comment had no host

[nicacioliveira]

The preview comment on #6233 shipped as:

### 🔍 Preview: https://

Built from `pr-6233-4ece050`.

No host.

Cause

When #6211 split the build into package / docker / publish, the comment steps moved into publish and their host reference changed from steps.meta.outputs.host to needs.package.outputs.host. That replacement also hit the declaration inside package:

  package:
    outputs:
      tag: ${{ steps.meta.outputs.tag }}
      host: ${{ needs.package.outputs.host }}   # reads its own output

A job cannot read its own outputs through needs. The expression resolves to empty, the step succeeds, and the workflow stays green.

The tag survived because its line was not part of that replacement — which is why the comment showed a correct image tag beside an empty URL, and why nothing looked broken until someone read it.

Assertion

helm-test.yml now rejects any job whose outputs reference needs.<itself>. Verified against the pre-fix workflow: it flags package.outputs -> needs.package, and passes here.

This is the second failure of this shape today — an expression that evaluates to nothing, produces no error, and leaves a green run. The first was preview.namespaceLabels never being passed, which rendered a namespace with no gateway label.

Impact

Cosmetic but load bearing: the sticky comment is how a reviewer gets the URL. Everything else about #6233 is fine; the environment is reachable at the address the ApplicationSet computed independently.

---

Summary by cubic

Fixes the preview sticky comment showing an empty host. Before: the comment rendered "Preview: https://". Now: it includes the correct host. Adds a CI guard so this class of mistake fails fast.

• Changes

  • In .github/workflows/preview-build.yaml, package.outputs.host now reads from ${{ steps.meta.outputs.host }} instead of needs.package.
  • In .github/workflows/helm-test.yml, add a check that fails if any job’s outputs reference needs.<same job>.

• Rollout

  • If any workflow defines outputs via needs.<same job>, update them to read from the producing step; otherwise CI will fail.

^{Written for commit ed78e36. Summary will update on new commits.}