chore: update flake #1574
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Helm Publish | |
| permissions: | |
| contents: read | |
| on: | |
| release: | |
| types: | |
| - published | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - v* | |
| paths-ignore: | |
| - 'docs/**' | |
| - '**/*.md' | |
| pull_request: | |
| paths-ignore: | |
| - 'docs/**' | |
| - '**/*.md' | |
| types: [labeled, unlabeled, opened, synchronize, reopened] | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write # Push to ghcr.io | |
| id-token: write # Needed to create an OIDC token for keyless signing | |
| # Condition: Run on tag push, published release, OR PR with 'ok-to-helm' label | |
| if: | | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || | |
| (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ok-to-helm')) || | |
| (github.event_name == 'release' && github.event.action == 'published') | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5 | |
| with: | |
| version: 'v4.2.3' | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Login to GHCR # required for cosign | |
| uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to GitHub Container Registry | |
| run: | | |
| echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin | |
| - name: Extract version from tag | |
| id: version | |
| run: | | |
| if [[ "${{ github.ref }}" == refs/tags/* ]]; then | |
| # Remove 'v' prefix from tag if present (e.g., v0.1.0 -> 0.1.0) | |
| VERSION=${GITHUB_REF_NAME#v} | |
| echo "source=tag" >> $GITHUB_OUTPUT | |
| else | |
| # For pull requests and other refs, compute a semver version | |
| # Format: 0.0.0-pr.<pr_number>.<short_sha> | |
| PR_NUMBER=${{ github.event.pull_request.number }} | |
| SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7) | |
| VERSION="0.0.0-pr.${PR_NUMBER}.${SHORT_SHA}" | |
| echo "source=computed" >> $GITHUB_OUTPUT | |
| fi | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| echo "Chart version: ${VERSION}" | |
| - name: Update chart version and appVersion | |
| run: | | |
| VERSION=${{ steps.version.outputs.version }} | |
| for chart in charts/*/; do | |
| if [ -f "${chart}Chart.yaml" ]; then | |
| CHART_NAME=$(basename "${chart}") | |
| echo "Updating ${CHART_NAME} to version ${VERSION}" | |
| # Update version and appVersion in Chart.yaml | |
| # Use | as delimiter to avoid issues with / in version strings | |
| sed -i "s|^version:.*|version: v${VERSION}|" "${chart}Chart.yaml" | |
| sed -i "s|^appVersion:.*|appVersion: \"v${VERSION}\"|" "${chart}Chart.yaml" | |
| echo "Updated Chart.yaml:" | |
| grep -E '^(version|appVersion):' "${chart}Chart.yaml" | |
| fi | |
| done | |
| - name: Package and publish Helm charts | |
| run: | | |
| for chart in charts/*/; do | |
| if [ -f "${chart}Chart.yaml" ]; then | |
| CHART_NAME=$(basename "${chart}") | |
| echo "Packaging and publishing chart: ${CHART_NAME}" | |
| # Package the chart | |
| helm package "${chart}" | |
| # Push to OCI registry | |
| PACKAGE=$(ls ${CHART_NAME}-*.tgz) | |
| helm push "${PACKAGE}" oci://ghcr.io/${{ github.repository_owner }}/charts &> push-metadata.txt | |
| echo "✓ Published ${PACKAGE} to ghcr.io/${{ github.repository_owner }}/charts" | |
| CHART_DIGEST=$(awk '/Digest: /{print $2}' push-metadata.txt) | |
| echo "CHART_DIGEST=${CHART_DIGEST}" | tee -a $GITHUB_ENV | |
| cosign sign --yes "ghcr.io/${{ github.repository_owner }}/charts/${CHART_NAME}@${CHART_DIGEST}" | |
| fi | |
| done |