Skip to content

Commit 103154d

Browse files
haasonsaashaasonsaas
committed
ci: add release workflow and docs
1 parent a0aff7a commit 103154d

File tree

5 files changed

+172
-0
lines changed

5 files changed

+172
-0
lines changed

‎.github/workflows/release-chart.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,12 @@ jobs:
2626
- name: Checkout
2727
uses: actions/checkout@v4
2828

29+
- name: Install yq
30+
run: |
31+
YQ_VERSION=v4.44.3
32+
sudo wget https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64 -O /usr/local/bin/yq
33+
sudo chmod +x /usr/local/bin/yq
34+
2935
- name: Set chart version
3036
if: ${{ inputs.version != '' }}
3137
run: |

‎.github/workflows/release.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Release
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: "Application version (used for tag/release, e.g. 1.2.3)"
8+
required: true
9+
chart_version:
10+
description: "Expected Helm chart version (default: read from Chart.yaml)"
11+
required: false
12+
13+
permissions:
14+
contents: write
15+
packages: write
16+
17+
env:
18+
CHART_DIR: charts/provenance
19+
CHART_NAME: provenance
20+
OCI_REGISTRY: ghcr.io/${{ github.repository_owner }}/charts
21+
22+
jobs:
23+
release:
24+
runs-on: ubuntu-latest
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v4
28+
29+
- name: Install dependencies (uv)
30+
uses: astral-sh/setup-uv@v1
31+
32+
- name: Sync Python dependencies
33+
run: uv sync --extra dev --extra dashboard --extra warehouse --extra client
34+
35+
- name: Run tests
36+
run: uv run -- pytest
37+
38+
- name: Set up Helm
39+
uses: azure/setup-helm@v3
40+
41+
- name: Install yq
42+
run: |
43+
YQ_VERSION=v4.44.3
44+
sudo wget https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64 -O /usr/local/bin/yq
45+
sudo chmod +x /usr/local/bin/yq
46+
47+
- name: Validate chart version
48+
run: |
49+
CHART_VERSION=$(yq '.version' $CHART_DIR/Chart.yaml)
50+
EXPECTED="${{ inputs.chart_version }}"
51+
if [ -n "$EXPECTED" ] && [ "$EXPECTED" != "$CHART_VERSION" ]; then
52+
echo "Chart version mismatch. Expected $EXPECTED, found $CHART_VERSION"
53+
exit 1
54+
fi
55+
echo "CHART_VERSION=$CHART_VERSION" >> $GITHUB_ENV
56+
57+
- name: Helm lint
58+
run: make helm-lint
59+
60+
- name: Helm template
61+
run: make helm-template
62+
63+
- name: Package chart
64+
run: |
65+
mkdir -p dist/charts
66+
helm package $CHART_DIR --destination dist/charts
67+
68+
- name: Login to GitHub Container Registry
69+
run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
70+
71+
- name: Push chart to OCI
72+
run: |
73+
CHART_PACKAGE="dist/charts/${CHART_NAME}-${CHART_VERSION}.tgz"
74+
helm push "$CHART_PACKAGE" oci://$OCI_REGISTRY
75+
76+
- name: Create GitHub Release
77+
id: create_release
78+
uses: actions/create-release@v1
79+
env:
80+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
81+
with:
82+
tag_name: v${{ inputs.version }}
83+
release_name: v${{ inputs.version }}
84+
draft: false
85+
prerelease: false
86+
generate_release_notes: true
87+
88+
- name: Upload chart artifact to release
89+
uses: actions/upload-release-asset@v1
90+
env:
91+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
92+
with:
93+
upload_url: ${{ steps.create_release.outputs.upload_url }}
94+
asset_path: dist/charts/${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}.tgz
95+
asset_name: ${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}.tgz
96+
asset_content_type: application/gzip

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,7 @@ The same process works against forks or sandboxes—helpful when validating new
229229
- [Deployment & Operations Guide](docs/deployment-guide.md) – Deploy with Docker/Kubernetes, scale detectors, and instrument observability.
230230
- [SARIF Reporting](docs/sarif-reporting.md) – Understand the SARIF 2.1.0 output, severity mapping, and customization hooks.
231231
- [DSSE Decision Bundles](docs/dsse-decision-bundles.md) – Inspect the envelope schema, verify signatures, and integrate with transparency logs.
232+
- [Release Process](docs/release-process.md) – Publish application releases and Helm charts with the bundled workflows.
232233

233234
## Data Persistence Model
234235

‎docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@ This directory contains task-focused guides that go deeper than the root `README
1010
- [Deployment & Operations Guide](deployment-guide.md) — Deploy the API with Docker or Kubernetes and operate it in production.
1111
- [SARIF Reporting](sarif-reporting.md) — Understand the SARIF 2.1.0 output and tailor it for downstream scanners.
1212
- [DSSE Decision Bundles](dsse-decision-bundles.md) — Inspect the DSSE envelope, verify signatures, and extend transparency workflows.
13+
- [Release Process](release-process.md) — Run end-to-end release workflows for the app and Helm chart.

‎docs/release-process.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Release Process
2+
3+
This guide summarizes how to publish Provenance application releases and Helm chart updates using the bundled automation.
4+
5+
## Prerequisites
6+
7+
- Write access to the repository and GitHub Container Registry (`ghcr.io/<org>/charts`).
8+
- Updated `charts/provenance/Chart.yaml` and application version metadata committed to `main`.
9+
- Successful CI run on the commit you plan to release.
10+
11+
## 1. Run Tests & Lint Locally (optional)
12+
13+
Although the release workflow repeats these steps, you can pre-flight locally:
14+
15+
```bash
16+
uv sync --all-extras
17+
uv run -- pytest
18+
make helm-lint
19+
make helm-template
20+
```
21+
22+
## 2. Publish a Release (app + chart)
23+
24+
Trigger the **Release** workflow (`.github/workflows/release.yml`) from the GitHub Actions tab or via the CLI:
25+
26+
```bash
27+
gh workflow run Release \
28+
--ref main \
29+
--field version=1.2.3 \
30+
--field chart_version=0.3.0
31+
```
32+
33+
The workflow:
34+
35+
1. Checks out `main` and installs dependencies.
36+
2. Runs the Python test suite and Helm lint/template checks.
37+
3. Packages the Helm chart and pushes it to `ghcr.io/<org>/charts`.
38+
4. Creates a GitHub release tagged `v<version>` with automatically generated notes.
39+
5. Uploads the packaged chart (`provenance-<chart_version>.tgz`) as a release asset.
40+
41+
## 3. Publish the Chart Only (optional)
42+
43+
If you need to republish the chart without cutting a full app release, use the **Release Helm Chart** workflow (`.github/workflows/release-chart.yml`). It packages the chart and pushes it to the OCI registry without creating a Git tag or release entry.
44+
45+
```bash
46+
gh workflow run "Release Helm Chart" \
47+
--ref main \
48+
--field version=0.3.0 \
49+
--field app_version=1.0.0
50+
```
51+
52+
## 4. Verify Artifacts
53+
54+
- Check the GitHub release page for the new tag, autogenerated notes, and the chart `.tgz` asset.
55+
- Confirm the OCI package exists: `helm pull oci://ghcr.io/<org>/charts/provenance --version 0.3.0`.
56+
57+
## 5. Announce / Deploy
58+
59+
- Notify stakeholders or trigger downstream deployment pipelines as required.
60+
- Update changelogs or internal docs if you maintain long-form release notes beyond the generated summary.
61+
62+
## Troubleshooting
63+
64+
- **Helm push failures** – Ensure `packages: write` permission is granted and the registry path matches your org or user.
65+
- **Version mismatch** – The release workflow will stop if `chart_version` input does not match `Chart.yaml`. Keep `Chart.yaml` in sync before starting the workflow.
66+
- **Existing tag** – The GitHub release step fails if `v<version>` already exists. Delete the tag or choose a new version.
67+
68+
For additional deployment details, see the [Deployment & Operations Guide](deployment-guide.md) and [Helm chart README](../charts/provenance/README.md).

0 commit comments

Comments
 (0)