vp-patterns/publish-charts #383
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is expected to be run by the git workflow of the remote | |
| # chart whenever a new target is pushed: | |
| # gh workflow run publish-charts.yml --repo mbaldessari/charts-test --ref main \ | |
| # -f SOURCE_TAG="v0.0.1" -f SOURCE_REPO="mbaldessari/helm-chart-test" | |
| name: vp-patterns/publish-charts | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| SOURCE_TAG: | |
| required: true | |
| description: The tag of the helm chart repo to build | |
| SOURCE_REPO: | |
| required: true | |
| description: The helm chart repo | |
| SOURCE_BRANCH_OVERRIDE: | |
| required: false | |
| description: If specified, checks out the head of this branch rather than the commit tagged by SOURCE_TAG | |
| default: "" | |
| TEMPLATE_DIR: | |
| required: false | |
| description: Directory containing the helm chart (relative to repo root). If not specified, will auto-detect Chart.yaml location | |
| default: "" | |
| env: | |
| SOURCE_TAG: "${{ inputs.SOURCE_TAG }}" | |
| SOURCE_REPO: "${{ inputs.SOURCE_REPO }}" | |
| SOURCE_BRANCH_OVERRIDE: "${{ inputs.SOURCE_BRANCH_OVERRIDE }}" | |
| TEMPLATE_DIR: "${{ inputs.TEMPLATE_DIR }}" | |
| UMBRELLA_REPO: "validatedpatterns/helm-charts" | |
| LEGACY_QUAY_BASE_URL: "oci://quay.io/hybridcloudpatterns" | |
| QUAY_BASE_URL: "oci://quay.io/validatedpatterns" | |
| jobs: | |
| update-charts: | |
| if: ${{ inputs.SOURCE_TAG }} | |
| runs-on: ubuntu-latest | |
| permissions: write-all | |
| steps: | |
| - name: Install Helm | |
| uses: azure/setup-helm@v5.0.0 | |
| with: | |
| version: v3.19.5 | |
| - name: Clone remote helm repo | |
| env: | |
| SOURCE_BRANCH_OVERRIDE: ${{ inputs.SOURCE_BRANCH_OVERRIDE }} | |
| run: |- | |
| set -e | |
| if [ -n "${SOURCE_BRANCH_OVERRIDE}" ]; then | |
| git clone "https://github.com/${SOURCE_REPO}.git" \ | |
| --branch "${SOURCE_BRANCH_OVERRIDE}" --single-branch helm-repo | |
| else | |
| git clone "https://github.com/${SOURCE_REPO}.git" \ | |
| --branch "${SOURCE_TAG}" --single-branch helm-repo | |
| fi | |
| - name: Detect chart directory | |
| run: |- | |
| set -euo pipefail | |
| cd helm-repo | |
| if [ -n "${TEMPLATE_DIR:-}" ]; then | |
| CHART_DIR="${TEMPLATE_DIR}" | |
| elif [ -f "Chart.yaml" ]; then | |
| CHART_DIR="." | |
| elif [ -f "chart/Chart.yaml" ]; then | |
| CHART_DIR="chart" | |
| elif [ -f "helm/Chart.yaml" ]; then | |
| CHART_DIR="helm" | |
| else | |
| echo "::error::Could not find Chart.yaml. Specify TEMPLATE_DIR input." | |
| exit 1 | |
| fi | |
| echo "CHART_DIR=${CHART_DIR}" >> "$GITHUB_ENV" | |
| - name: Build chart dependencies | |
| run: |- | |
| set -euo pipefail | |
| cd "helm-repo/${CHART_DIR}" | |
| if ! yq -e '.dependencies' Chart.yaml > /dev/null 2>&1; then | |
| echo "No dependencies declared in Chart.yaml" | |
| exit 0 | |
| fi | |
| helm dependency update | |
| - name: Package the helm chart | |
| run: |- | |
| set -euo pipefail | |
| cd helm-repo | |
| helm package "${CHART_DIR}" | |
| CHART_NAME=$(yq -r '.name' "${CHART_DIR}/Chart.yaml") | |
| CHART_VERSION=$(yq -r '.version' "${CHART_DIR}/Chart.yaml") | |
| CHART_TGZ="${CHART_NAME}-${CHART_VERSION}.tgz" | |
| mv "${CHART_TGZ}" .. | |
| echo "CHART_NAME=${CHART_NAME}" >> "$GITHUB_ENV" | |
| echo "CHART_VERSION=${CHART_VERSION}" >> "$GITHUB_ENV" | |
| echo "CHART_TGZ=${CHART_TGZ}" >> "$GITHUB_ENV" | |
| # - name: Sign the chart | |
| # shell: bash | |
| # env: | |
| # GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} | |
| # run: |- | |
| # set -euo pipefail | |
| # echo ${{ secrets.GPG_SECRET_SUBKEY }} | base64 -d | gpg --batch --import | |
| # echo ${{ secrets.GPG_PUBLIC_KEY }} | base64 -d | gpg --batch --import | |
| # # Needed because helm verify only supports old format | |
| # gpg --export >~/.gnupg/pubring.gpg | |
| # pip install git+https://gitlab.com/mbaldessari/helm-sign.git@couple-of-fixes | |
| # helm-sign ${{ env.CHART_TGZ }} | |
| # helm verify ${{ env.CHART_TGZ }} | |
| - name: Upload helm package as a release asset | |
| uses: svenstaro/upload-release-action@v2 | |
| with: | |
| repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| file: ${{ env.CHART_TGZ }} | |
| asset_name: ${{ env.CHART_TGZ }} | |
| tag: ${{ github.ref }} | |
| body: "${{ env.CHART_NAME }} Released ${{ env.CHART_VERSION }}" | |
| overwrite: true | |
| # - name: Upload helm package signature as a release asset | |
| # uses: svenstaro/upload-release-action@v2 | |
| # with: | |
| # repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| # file: ${{ env.CHART_TGZ }}.prov | |
| # asset_name: ${{ env.CHART_TGZ }}.prov | |
| # tag: ${{ github.ref }} | |
| # body: "${{ env.CHART_NAME }} Released ${{ env.CHART_VERSION }}" | |
| # overwrite: true | |
| # Uploaded to https://github.com/validatedpatterns/helm-charts/releases/download/main/test-0.0.1.tgz | |
| - name: Push the chart to legacy and new quay repos | |
| run: |- | |
| set -e | |
| helm registry login -u="${{ secrets.LEGACY_QUAY_USERNAME }}" -p="${{ secrets.LEGACY_QUAY_PASSWORD }}" quay.io | |
| helm push "${{ env.CHART_TGZ }}" "${LEGACY_QUAY_BASE_URL}" | |
| helm registry login -u="${{ secrets.QUAY_USERNAME }}" -p="${{ secrets.QUAY_PASSWORD }}" quay.io | |
| helm push "${{ env.CHART_TGZ }}" "${QUAY_BASE_URL}" | |
| - name: Update charts site | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: |- | |
| gh workflow run deploy-site.yml \ | |
| --repo validatedpatterns/helm-charts \ | |
| --ref main \ |