release.yml

name: Release Charts

on:
  push:
    branches: [ main ]
    paths:
      - 'charts/**'
      - '.github/workflows/release.yml'

  pull_request:
    branches: [ main ]
    paths:
      - 'charts/**'
      - '.github/workflows/release.yml'

jobs:
  lint-test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.16.3

      - uses: actions/setup-python@v5
        with:
          python-version: 3.11

      - name: Set up chart-testing
        uses: helm/chart-testing-action@v2.7.0

      - name: Add dependency chart repos
        run: |
          helm repo add jetstack https://charts.jetstack.io
          helm repo add community-charts https://community-charts.github.io/helm-charts

      - name: Run chart-testing (list-changed)
        id: list-changed
        run: |
          ## If executed with debug this won't work anymore.
          changed=$(ct --config ./.github/configs/ct-lint.yaml list-changed)
          charts=$(echo "$changed" | tr '\n' ' ' | xargs)
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> $GITHUB_OUTPUT
            echo "changed_charts=$charts" >> $GITHUB_OUTPUT
          fi

      - name: Run Artifact Hub lint
        run: |
          curl -s https://api.github.com/repos/artifacthub/hub/releases/latest \
            | grep -E 'browser_download_url' \
            | grep linux_amd64 \
            | grep -Eo 'https://[^\"]*' \
            | xargs wget -q -O - \
            | tar -xz

          for CHART in charts/*; do
            if [ -d "$CHART" ]; then
              echo "Linting $CHART"
              ./ah lint -p "$CHART" || exit 1
            fi
          done
          echo "All charts linted successfully."

          rm -f ./ah

      - name: install helm unittest plugin
        if: steps.list-changed.outputs.changed == 'true'
        run: |
          helm env
          helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.7.0

      - name: Run chart-testing (lint)
        run: ct lint --debug --config ./.github/configs/ct-lint.yaml --lint-conf ./.github/configs/lintconf.yaml

      - name: Create kind cluster
        uses: helm/kind-action@v1.12.0
        if: steps.list-changed.outputs.changed == 'true'

      - name: Run chart-testing (install)
        run: ct install --config ./.github/configs/ct-lint.yaml
        if: steps.list-changed.outputs.changed == 'true'

  release:
    needs: lint-test

    runs-on: ubuntu-latest

    if: ${{ github.event_name != 'pull_request' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: v3.16.3

      - name: Prepare GPG environment for Helm
        id: import-gpg
        run: |
          GNUPG_DIR="$(mktemp --directory --tmpdir=${{ runner.temp }})"

          # Import GPG passphrase
          echo '${{ secrets.GPG_PASSPHRASE }}' > "${GNUPG_DIR}/passphrase"
          echo "passphrase-file=${GNUPG_DIR}/passphrase" >> "${GITHUB_OUTPUT}"

          # Import GPG signing key
          echo '${{ secrets.GPG_KEYRING_BASE64 }}' | base64 -d | gpg --dearmor > "${GNUPG_DIR}/secring.gpg"
          echo "keyring=${GNUPG_DIR}/secring.gpg" >> "${GITHUB_OUTPUT}"

      - name: Add dependency chart repos
        run: |
          helm repo add jetstack https://charts.jetstack.io
          helm repo add bitnami https://charts.bitnami.com/bitnami
          helm repo add community-charts https://community-charts.github.io/helm-charts
          helm repo add minio https://charts.min.io

      - name: Run chart-releaser
        uses: helm/chart-releaser-action@v1.7.0
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          CR_KEY: "${{ secrets.CR_KEY }}"
          CR_KEYRING: ${{ steps.import-gpg.outputs.keyring }}
          CR_PASSPHRASE_FILE: ${{ steps.import-gpg.outputs.passphrase-file }}
          CR_SIGN: "true"
          CR_SKIP_EXISTING: "true"