release.yaml

name: Release Helm Charts

on:
  workflow_call:
    secrets:
      oci_password:
        description: OCI registry password.
        required: false
    inputs:
      chart_dir:
        description: Directory containing the charts to validate.
        type: string
        required: false
        default: charts
      helm_repos:
        description: List of Helm repos to install; as a comma separated list in the format `<name>=<address>`.
        type: string
        required: false
        default: ""
      release_name_version_prefix:
        description: Prefix for the release name version.
        type: string
        required: false
        default: ""
      release_as_latest:
        description: If the release should be created as latest.
        type: boolean
        required: false
        default: true
      release_notes:
        description: If the release notes should be created from a CHANGELOG.
        type: boolean
        required: false
        default: false
      publish_gh_pages:
        description: If the chart should be released to the current repository's GH Pages.
        type: boolean
        required: false
        default: true
      publish_oci:
        description: If the chart should be released to an OCI registry.
        type: boolean
        required: false
        default: false
      oci_registry:
        description: OCI registry to publish the charts to.
        type: string
        required: false
        default: "ghcr.io"
      oci_username:
        description: OCI registry username.
        type: string
        required: false
        default: ${{ github.actor }}
      oci_repository_prefix:
        description: OCI repository prefix, will default to the current repository name.
        type: string
        required: false
        default: ${{ github.repository }}
      artifact_hub_config_file:
        description: Name of the Artifact Hub repository configuration file.
        type: string
        required: false
        default: artifacthub-repo.yaml
      ah_lint:
        description: If the Artifact Hub linter should be run.
        type: boolean
        required: false
        default: true

jobs:
  check:
    name: Check releasable charts
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    outputs:
      release: ${{ steps.charts.outputs.release }}
      matrix: ${{ steps.charts.outputs.matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Install YQ
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        with:
          github_token: ${{ github.token }}
          owner: mikefarah
          repository: yq
          extract: false
          filename_format: "{name}_{os}_{arch}"
          check_command: yq --version
          version: latest

      - name: Check for Helm charts to release
        id: charts
        env:
          INPUT_CHART_DIR: ${{ inputs.chart_dir }}
          INPUT_RELEASE_NAME_VERSION_PREFIX: ${{ inputs.release_name_version_prefix }}
        run: |
          set -euo pipefail

          release_charts=""

          for chart_dir in "./${INPUT_CHART_DIR}"/*
          do
            if [[ -d "${chart_dir}" ]]
            then
              chart="$(basename "${chart_dir}")"
              released_version="$(git tag -l --sort version:refname "${chart}-*" | tail -n 1 | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' || true)"
              current_version="$(yq eval '.version' "./${INPUT_CHART_DIR}/${chart}/Chart.yaml")"

              if [[ "${current_version}" != "${released_version}" ]] && [[ -z "$(git tag -l "${chart}-${INPUT_RELEASE_NAME_VERSION_PREFIX}${current_version}")" ]]
              then
                echo "Chart: ${chart}, Released version: ${released_version}, Current version: ${current_version}"
                release_charts="${release_charts}${chart},"
              fi
            fi
          done

          if [[ -n "${release_charts}" ]]
          then
            echo "release=true" >> "${GITHUB_OUTPUT}"
          else
            echo "release=false" >> "${GITHUB_OUTPUT}"
          fi

          echo "matrix=$(jq -Rrc 'split(",")' <<< "${release_charts%,}")" >> "${GITHUB_OUTPUT}"

  release:
    name: Release Helm charts
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      contents: write
      id-token: write
      packages: write
    defaults:
      run:
        shell: bash
    needs: check
    if: needs.check.outputs.release == 'true'
    strategy:
      max-parallel: 1
      matrix:
        chart: ${{ fromJson(needs.check.outputs.matrix) }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Install YQ
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        with:
          github_token: ${{ github.token }}
          owner: mikefarah
          repository: yq
          extract: false
          filename_format: "{name}_{os}_{arch}"
          check_command: yq --version
          version: latest

      - name: Install MDQ
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        if: inputs.release_notes
        with:
          github_token: ${{ github.token }}
          owner: yshavit
          repository: mdq
          arch_amd64: x64
          filename_format: "{name}-{os}-{arch}.{ext}"
          check_command: mdq --version
          version: latest

      - name: Install Artifact Hub CLI
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        if: inputs.ah_lint
        with:
          github_token: ${{ github.token }}
          owner: artifacthub
          repository: hub
          name: ah
          check_command: ah version
          version: latest

      - name: Install Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: latest

      - name: Configure Helm repos
        if: inputs.helm_repos
        env:
          INPUT_HELM_REPOS: ${{ inputs.helm_repos }}
        run: |
          set -euo pipefail

          read -ra repos <<< "${INPUT_HELM_REPOS//,/ }"
          for repo in "${repos[@]}"
          do
            helm repo add "${repo%=*}" "${repo#*=}"
          done

      - name: Install chart-releaser
        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
        with:
          install_only: true

      - name: Configure Git
        run: |
          set -euo pipefail
          git config user.name "${GITHUB_ACTOR}"
          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"

      - name: Get chart version
        id: chart_version
        env:
          INPUT_CHART_DIR: ${{ inputs.chart_dir }}
          INPUT_CHART: ${{ matrix.chart }}
        run: |
          set -euo pipefail
          echo "version=$(yq eval '.version' "./${INPUT_CHART_DIR}/${INPUT_CHART}/Chart.yaml")" >> "${GITHUB_OUTPUT}"

      - name: Get changelog entry
        uses: mindsers/changelog-reader-action@32aa5b4c155d76c94e4ec883a223c947b2f02656 # v2.2.3
        id: changelog_reader
        if: inputs.release_notes
        with:
          path: ./${{ inputs.chart_dir }}/${{ matrix.chart }}/CHANGELOG.md
          version: v${{ steps.chart_version.outputs.version }}

      - name: Package chart
        id: package
        env:
          INPUT_CHART_DIR: ${{ inputs.chart_dir }}
          INPUT_CHART: ${{ matrix.chart }}
          INPUT_CHART_VERSION: ${{ steps.chart_version.outputs.version }}
          INPUT_RELEASE_NOTES: ${{ inputs.release_notes }}
          INPUT_CHANGELOG: ${{ steps.changelog_reader.outputs.changes }}
          INPUT_AH_LINT: ${{ inputs.ah_lint }}
        run: |
          set -euo pipefail

          package_dir="./.cr-release-packages"
          mkdir -p "${package_dir}"

          release_notes_file="RELEASE.md"

          if [[ "${INPUT_RELEASE_NOTES}" == "true" ]]; then
            release_notes_path="./${INPUT_CHART_DIR}/${INPUT_CHART}/${release_notes_file}"
            printf '%s\n' "${INPUT_CHANGELOG}" > "${release_notes_path}"

            added="$(mdq --output plain '# Added | -' <"${release_notes_path}" || true)"
            changed="$(mdq --output plain '# Changed | -' <"${release_notes_path}" || true)"
            deprecated="$(mdq --output plain '# Deprecated | -' <"${release_notes_path}" || true)"
            removed="$(mdq --output plain '# Removed | -' <"${release_notes_path}" || true)"
            fixed="$(mdq --output plain '# Fixed | -' <"${release_notes_path}" || true)"
            security="$(mdq --output plain '# Security | -' <"${release_notes_path}" || true)"

            changes_path="./${INPUT_CHART_DIR}/${INPUT_CHART}/changes.txt"
            rm -f "${changes_path}"

            old_ifs="${IFS}"
            IFS=$'\n'

            for item in ${added}; do
              printf -- '- kind: added\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${changed}; do
              printf -- '- kind: changed\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${deprecated}; do
              printf -- '- kind: deprecated\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${removed}; do
              printf -- '- kind: removed\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${fixed}; do
              printf -- '- kind: fixed\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            for item in ${security}; do
              printf -- '- kind: security\n  description: "%s"\n' "${item%.*}." >> "${changes_path}"
            done

            IFS="${old_ifs}"

            if [[ -f "${changes_path}" ]]; then
              changes="$(cat "${changes_path}")" yq eval --inplace '.annotations["artifacthub.io/changes"] |= strenv(changes)' "./${INPUT_CHART_DIR}/${INPUT_CHART_DIR}/Chart.yaml"
              rm -f "${changes_path}"
            fi
          fi

          if [[ "${INPUT_AH_LINT}" == "true" ]]; then
            ah lint --kind helm --path "./${INPUT_CHART_DIR}" || exit 1
          fi

          cr package --package-path="${package_dir}" "./${INPUT_CHART_DIR}/${INPUT_CHART_DIR}"

          echo "path=${package_dir}/${INPUT_CHART_DIR}-${INPUT_CHART_VERSION}.tgz" >> "${GITHUB_OUTPUT}"
          echo "release_notes_file=${release_notes_file}" >> "${GITHUB_OUTPUT}"

      - name: Create chart GH release
        env:
          GITHUB_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
          INPUT_PACKAGE_PATH: ${{ steps.package.outputs.path }}
          INPUT_RELEASE_NAME_VERSION_PREFIX: ${{ inputs.release_name_version_prefix }}
          INPUT_RELEASE_NOTES_FILE: ${{ steps.package.outputs.release_notes_file }}
          INPUT_RELEASE_AS_LATEST: ${{ inputs.release_as_latest }}
        run: |
          set -euo pipefail

          package_dir="$(dirname "${INPUT_PACKAGE_PATH}")"
          release_name_template="{{ .Name }}-${INPUT_RELEASE_NAME_VERSION_PREFIX}{{ .Version }}"

          cr upload --token="${GITHUB_TOKEN}" --owner="${GITHUB_REPOSITORY_OWNER}" --git-repo="${GITHUB_REPOSITORY_NAME}" --commit="${GITHUB_SHA}" --package-path="${package_dir}" --release-name-template="${release_name_template}" --release-notes-file="${INPUT_RELEASE_NOTES_FILE}" --make-release-latest="${INPUT_RELEASE_AS_LATEST}"

      - name: Login to OCI registry
        if: inputs.publish_oci
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ${{ inputs.oci_registry }}
          username: ${{ inputs.oci_username }}
          password: ${{ secrets.oci_password || github.token }}

      - name: Install Crane
        if: inputs.publish_oci
        uses: imjasonh/setup-crane@6da1ae018866400525525ce74ff892880c099987 # v0.5

      - name: Install ORAS
        if: inputs.publish_oci
        uses: action-stars/install-tool-from-github-release@1fa61c3bea52eca3bcdb1f5c961a3b113fe7fa54 # v0.2.6
        with:
          github_token: ${{ github.token }}
          owner: oras-project
          repository: oras
          check_command: oras version
          version: latest

      - name: Configure OCI repository
        id: oci
        if: inputs.publish_oci
        env:
          INPUT_OCI_REGISTRY: ${{ inputs.oci_registry }}
          INPUT_OCI_REPOSITORY_PREFIX: ${{ inputs.oci_repository_prefix }}
          INPUT_CHART: ${{ matrix.chart }}
          INPUT_CHART_DIR: ${{ inputs.chart_dir }}
          INPUT_ARTIFACT_HUB_CONFIG_FILE: ${{ inputs.artifact_hub_config_file }}
        run: |
          set -euo pipefail

          oci_repository="${INPUT_OCI_REGISTRY}/${INPUT_OCI_REPOSITORY_PREFIX}/${INPUT_CHART}"

          ah_config_path="./${INPUT_CHART_DIR}/${INPUT_CHART}/${INPUT_ARTIFACT_HUB_CONFIG_FILE}"

          if [[ -f "${ah_config_path}" ]]
          then
            date_epoch="$(git log -1 --format='%ct' "${ah_config_path}")"
            created_date="$(date -u --date="@${date_epoch}" "+%Y-%m-%dT%H:%M:%SZ" 2>/dev/null)"

            image_config_path="$(mktemp)"
            echo "{}" > "${image_config_path}"

            media_type="application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml"
            oci_image="${oci_repository}:artifacthub.io"

            oras push --annotation "org.opencontainers.image.created=${created_date}" --config "${image_config_path}:application/vnd.cncf.artifacthub.config.v1+yaml" "${oci_image}" "${ah_config_path}:${media_type}"
          fi

          {
            echo "repository=${oci_repository}"
          } >> "${GITHUB_OUTPUT}"

      - name: Install Cosign
        if: inputs.publish_oci
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: Publish chart to OCI repository
        id: publish_oci
        if: inputs.publish_oci
        env:
          GITHUB_TOKEN: ${{ github.token }}
          INPUT_OCI_REGISTRY: ${{ inputs.oci_registry }}
          INPUT_OCI_REPOSITORY: ${{ steps.oci.outputs.repository }}
          INPUT_CHART_DIR: ${{ inputs.chart_dir }}
          INPUT_CHART: ${{ matrix.chart }}
          INPUT_CHART_VERSION: ${{ steps.chart_version.outputs.version }}
          INPUT_PACKAGE_PATH: ${{ steps.package.outputs.path }}
        run: |
          set -euo pipefail

          oci_repository="${INPUT_OCI_REPOSITORY}"
          oci_image="${oci_repository}:${INPUT_CHART_VERSION}"

          helm registry login --username "${GITHUB_ACTOR}" --password "${GITHUB_TOKEN}" "${INPUT_OCI_REGISTRY}"
          helm push "${INPUT_PACKAGE_PATH}" "oci://$(dirname "${oci_repository}")"

          digest="$(crane digest "${oci_image}")"
          cosign sign --yes "${oci_image}@${digest}"

          {
            echo "image=${oci_image}"
            echo "digest=${digest}"
          } >> "${GITHUB_OUTPUT}"

      - name: Attest OCI image
        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
        with:
          subject-name: ${{ steps.oci.outputs.repository }}
          subject-digest: ${{ steps.publish_oci.outputs.digest }}
          push-to-registry: true

      - name: Publish chart to GH Pages
        if: inputs.publish_gh_pages
        env:
          GITHUB_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
          INPUT_PACKAGE_PATH: ${{ steps.package.outputs.path }}
        run: |
          set -euo pipefail

          index_dir="./.cr-index"
          mkdir -p "${index_dir}"

          package_dir="$(dirname "${INPUT_PACKAGE_PATH}")"

          cr index --token="${GITHUB_TOKEN}" --push --owner="${GITHUB_REPOSITORY_OWNER}" --git-repo="${GITHUB_REPOSITORY_NAME}" --package-path="${package_dir}" --index-path="${index_dir}/index.yaml"