release.yml

name: Release Charts

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      chart:
        description: Chart to release
        required: true
        type: choice
        options:
          - nes-node-web
          - universal-chart
      bump:
        description: Version bump to apply
        required: true
        type: choice
        options:
          - patch
          - minor
          - major
        default: patch
      force:
        description: Force a release even without detected changes
        required: true
        type: choice
        options:
          - "false"
          - "true"
        default: "false"

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      charts: ${{ steps.manual.outputs.charts || steps.filter.outputs.changes }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Use manual chart selection
        id: manual
        if: github.event_name == 'workflow_dispatch'
        run: |
          chart="${{ github.event.inputs.chart }}"
          printf 'charts=["%s"]\n' "$chart" >> "$GITHUB_OUTPUT"

      - name: Build chart filters
        id: filters
        if: github.event_name != 'workflow_dispatch'
        run: |
          filters_file="$RUNNER_TEMP/chart-filters.yml"
          for chart in charts/*; do
            [[ -d "$chart" ]] || continue
            printf "%s:\n  - '%s/**'\n" "$(basename "$chart")" "$chart"
          done >"$filters_file"

          echo "file=$filters_file" >>"$GITHUB_OUTPUT"

      - name: Detect chart changes
        id: filter
        if: github.event_name != 'workflow_dispatch'
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        with:
          filters: ${{ steps.filters.outputs.file }}

      - name: No chart changes detected
        if: steps.filter.outputs.changes == '[]' && github.event_name != 'workflow_dispatch'
        run: echo "No chart changes detected."

  release:
    needs: detect-changes
    if: needs.detect-changes.outputs.charts != '[]'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    strategy:
      fail-fast: false
      # Avoid race conditions when updating the GitHub Pages site.
      max-parallel: 1
      matrix:
        chart: ${{ fromJson(needs.detect-changes.outputs.charts) }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Capture previous chart tag
        id: previous-tag
        run: |
          tag_prefix="${{ matrix.chart }}-"
          previous_tag=$(git tag -l "${tag_prefix}*" --sort=-version:refname | head -n1)
          echo "tag=$previous_tag" >> "$GITHUB_OUTPUT"

      - name: Determine next tag
        id: next-tag
        uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # 1.75.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_BRANCHES: main
          TAG_PREFIX: "${{ matrix.chart }}-"
          DEFAULT_BUMP: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.bump || 'patch' }}
          FORCE_WITHOUT_CHANGES: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.force == 'true' }}

      - name: Update chart version
        id: version
        run: |
          tag_prefix="${{ matrix.chart }}-"
          next_tag="${{ steps.next-tag.outputs.new_tag }}"
          version="${next_tag#${tag_prefix}}"

          if [[ -z "$version" || "$version" == "$next_tag" ]]; then
            echo "Failed to determine version from tag: $next_tag" >&2
            exit 1
          fi

          chart_file="charts/${{ matrix.chart }}/Chart.yaml"
          backup_file="${chart_file}.bak"

          sed -i.bak -E "s/^version:[[:space:]]*.*/version: \"$version\"/" "$chart_file"

          if [[ ! -f "$chart_file" || ! -s "$chart_file" ]]; then
            echo "Failed to update version in $chart_file" >&2
            mv "$backup_file" "$chart_file"
            exit 1
          fi

          rm -f "$backup_file"
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Install chart-releaser
        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
        with:
          install_only: "true"

      - name: Set package dir
        run: echo "PACKAGE_DIR=${{ runner.temp }}/packages" >> "$GITHUB_ENV"

      - name: Package chart
        run: |
          mkdir -p "$PACKAGE_DIR"
          cr package "charts/${{ matrix.chart }}" --package-path "$PACKAGE_DIR"

      - name: Generate release notes
        id: notes
        run: |
          notes_file="$RUNNER_TEMP/release-notes-${{ matrix.chart }}.md"
          last_tag="${{ steps.previous-tag.outputs.tag }}"
          log_args=()
          if [[ -n "$last_tag" ]]; then
            log_args+=("${last_tag}..HEAD")
          fi
          changes=$(git log "${log_args[@]}" --pretty=format:'- %s (%h)' -- \
            "charts/${{ matrix.chart }}")
          {
            echo "## Changes"
            if [[ -n "$changes" ]]; then
              echo "$changes"
            else
              echo "_No chart changes detected._"
              if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
                echo ""
                echo "_Manual bump: no chart changes detected._"
              fi
            fi
          } > "$notes_file"
          echo "notes_file=$notes_file" >> "$GITHUB_OUTPUT"

      - name: Publish chart release and index
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
        run: |
          owner="${GITHUB_REPOSITORY_OWNER}"
          repo="${GITHUB_REPOSITORY#*/}"
          # cr index writes index.yaml atomically via temporary files under .cr-index/
          rm -rf .cr-index
          mkdir -p .cr-index
          cr upload -o "$owner" -r "$repo" -c "$GITHUB_SHA" --skip-existing \
            --package-path "$PACKAGE_DIR"
          cr index -o "$owner" -r "$repo" --push --package-path "$PACKAGE_DIR"

      - name: Update release notes
        env:
          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
        run: |
          release_tag="${{ matrix.chart }}-${{ steps.version.outputs.version }}"
          gh release edit "$release_tag" --notes-file "${{ steps.notes.outputs.notes_file }}"

      - name: Authenticate to GHCR
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push chart to GHCR
        run: |
          package_path="$PACKAGE_DIR/${{ matrix.chart }}-${{ steps.version.outputs.version }}.tgz"
          if [[ ! -f "$package_path" ]]; then
            echo "No packaged chart found for ${{ matrix.chart }}" >&2
            exit 1
          fi
          helm push "$package_path" "oci://ghcr.io/${{ github.repository_owner }}/charts"