test release

Author: masterkain

.github/workflows/release.yml

@@ -11,51 +11,56 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      # 1) Checkout code
+      # 1. Checkout
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      # 2) Git config
+      # 2. Configure Git
       - name: Configure Git
         run: |
           git config user.name  "$GITHUB_ACTOR"
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
-      # 3) Install Helm
+      # 3. Install Helm
       - name: Install Helm
         uses: azure/setup-helm@v4.3.0
 
-      # 4) Import your private key (ASCII-armored export contains both pub & sec)
+      # 4. Import your ASCII-armored secret key (contains both public & private)
       - name: Import GPG private key
         run: |
           echo "${{ secrets.GPG_PRIVATE_KEY }}" \
             | gpg --batch --yes --import
-        # gpg import reads both public & secret key material :contentReference[oaicite:2]{index=2}
+        # Expects secrets.GPG_PRIVATE_KEY = output of:
+        #   gpg --armor --export-secret-keys <KEYID> :contentReference[oaicite:5]{index=5}
 
-      # 5) Enable loopback pinentry so Helm’s passphrase-file is respected
+      # 5. Enable loopback pinentry so --passphrase-file works in batchmode
       - name: Enable GPG loopback pinentry
         run: |
+          # Allow loopback in agent and gpg itself
+          printf "%s\n" "allow-loopback-pinentry" \
+            >> ~/.gnupg/gpg-agent.conf
           printf "%s\n" "pinentry-mode loopback" \
             >> ~/.gnupg/gpg.conf
+          # Restart the agent to pick up changes
           gpgconf --kill gpg-agent
-        # Without this, GnuPG ignores --passphrase-file in non-TTY contexts
+        # Without this, GPG in batchmode cannot read passphrases :contentReference[oaicite:6]{index=6}
 
-      # 6) Export to legacy keyring files that Helm expects
+      # 6. Export legacy keyring files that Helm expects
       - name: Export legacy .gpg keyrings
         run: |
           mkdir -p ~/.gnupg
-          # Public keyring
+          # Export public keys into legacy pubring.gpg
           gpg --batch --yes --export "${{ secrets.CR_KEY }}" \
             > ~/.gnupg/pubring.gpg
-          # Secret keyring
+          # Export secret keys into legacy secring.gpg
           gpg --batch --yes --export-secret-keys "${{ secrets.CR_KEY }}" \
             > ~/.gnupg/secring.gpg
           ls -l ~/.gnupg/pubring.gpg ~/.gnupg/secring.gpg
-        # Helm’s provenance tooling looks specifically for these files
+        # Helm’s provenance tooling looks for these hard-coded paths :contentReference[oaicite:7]{index=7}
 
-      # 7) Package & sign each chart (produces .tgz + .tgz.prov)
+      # 7. Package & sign each chart
       - name: Package & sign charts
         shell: bash
         run: |
@@ -68,31 +73,28 @@ jobs:
               --passphrase-file <(echo "${{ secrets.GPG_PASSPHRASE }}") \
               --destination .cr-release-packages
           done
-        # The --keyring and --passphrase-file flags now work in CI :contentReference[oaicite:5]{index=5}
+        # Now GPG will read the passphrase and keyring non-interactively :contentReference[oaicite:8]{index=8}
 
-      # 8) Publish the signed charts (skip re-packaging)
+      # 8. Publish the signed charts (no re-packaging)
       - name: Publish signed charts
         uses: helm/chart-releaser-action@v1.7.0
         with:
           skip_existing:  true
           skip_packaging: true
         env:
           CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CR_SIGN:  false
+          CR_SIGN:  false   # Already signed above :contentReference[oaicite:9]{index=9}
 
-      # 9) Login to GHCR for OCI pushes
+      # 9. Login to GHCR for OCI pushes
       - name: Login to GHCR
         uses: docker/login-action@v3
         with:
-          registry:   ghcr.io
-          username:   ${{ github.actor }}
-          password:   ${{ secrets.GITHUB_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      # 10) Push OCI charts to GHCR
+      # 10. Push OCI charts to GHCR
       - name: Push Charts to GHCR
         shell: bash
         run: |
-          for pkg in .cr-release-packages/*; do
-            [ -e "$pkg" ] || continue
-            helm push "$pkg" oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts
-          done
+          for