Skip to content

Commit c8e3356

Browse files
at88mphat88mph
authored
Merge pull request #107 from shinybrar/conflict-fix
CI/CD: Automation
2 parents eafb2a1 + d9b3bbb commit c8e3356

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+1902
-259
lines changed

‎.github/dependabot.yaml‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎.github/renovate-config.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"onboarding": true,
4+
"extends": ["config:recommended", "helpers:pinGitHubActionDigests"],
5+
"prConcurrentLimit": 20,
6+
"prHourlyLimit": 20,
7+
"repositories": ["shinybrar/deployments"],
8+
"platform": "github",
9+
"semanticCommits": "enabled",
10+
"commitMessagePrefix": "renovate/chore(deps): ",
11+
"allowedCommands": ["uv run pre-commit run -a"]
12+
}

‎.github/renovate-entrypoint.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/bash
2+
3+
echo "Running Renovate Entrypoint Script"
4+
5+
# Install uv
6+
echo "Installing uv"
7+
curl -LsSf https://astral.sh/uv/install.sh | sh
8+
echo "uv Installed: $(which uv)"
9+
# Install Helm
10+
echo "Installing Helm"
11+
install-tool helm 3.19.0
12+
echo "Helm Installed: $(which helm)"
13+
# Install Go
14+
echo "Installing Go"
15+
install-tool golang 1.25.3
16+
echo "Go Installed: $(which go)"
17+
# Install Helm Docs
18+
echo "Installing Helm Docs"
19+
go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
20+
echo "Helm Docs Installed: $(which helm-docs)"
21+
# Run renovate bot
22+
renovate
23+
echo "Renovate Run Complete"

‎.github/workflows/docs.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ jobs:
2424
runs-on: ubuntu-latest
2525
steps:
2626
- name: Checkout
27-
uses: actions/checkout@v4.2.2
27+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2828
with:
2929
fetch-depth: 0
3030

3131
- name: Install uv
32-
uses: astral-sh/setup-uv@v5
32+
uses: astral-sh/setup-uv@2ddd2b9cb38ad8efd50337e8ab201519a34c9f24 # v7
3333

3434
- name: Setup Python
3535
run: uv python install

‎.github/workflows/helm-publish.yml‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
name: Publish Helm Charts
2+
3+
on:
4+
repository_dispatch:
5+
types: [helm-release-build]
6+
7+
permissions:
8+
contents: write # Required for uploading release assets
9+
packages: write
10+
id-token: write # Required for keyless signing with Sigstore
11+
attestations: write # Required for GitHub attestations
12+
13+
jobs:
14+
publish:
15+
runs-on: ubuntu-latest
16+
environment: production # Use deployment environment for secrets
17+
steps:
18+
- name: Print Incoming Payload
19+
id: payload
20+
run: |
21+
echo "=== Repository Dispatch Payload ==="
22+
echo '${{ toJson(github.event.client_payload) }}'
23+
echo "=== End Payload ==="
24+
25+
- name: Checkout Code
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
27+
with:
28+
ref: ${{ github.event.client_payload.sha }}
29+
30+
- name: Set up Helm
31+
uses: Azure/[email protected]
32+
33+
- name: Install Cosign
34+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
35+
36+
- name: Log in to OCI Registry
37+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
38+
with:
39+
registry: ${{ secrets.HELM_REGISTRY }}
40+
username: ${{ secrets.HELM_USERNAME }}
41+
password: ${{ secrets.HELM_PASSWORD }}
42+
43+
- name: Package Helm Chart
44+
id: package
45+
run: |
46+
echo "Packaging Helm Chart: ${{ github.event.client_payload.chart_name }} v${{ github.event.client_payload.chart_version }}"
47+
48+
# Create output directory
49+
mkdir -p helm-packages
50+
51+
# Running Helm Update
52+
echo "Running Helm Dependency Update"
53+
helm dependency update ${{ github.event.client_payload.chart_path }}
54+
55+
# Package and sign the chart with GPG key
56+
helm package ${{ github.event.client_payload.chart_path }} \
57+
--destination helm-packages \
58+
--version ${{ github.event.client_payload.chart_version }}
59+
60+
# Get the package filename
61+
CHART_PACKAGE=$(ls helm-packages/*.tgz | head -1)
62+
echo "CHART_PACKAGE=$CHART_PACKAGE" >> $GITHUB_OUTPUT
63+
64+
echo "Chart Packaged: $CHART_PACKAGE"
65+
66+
- name: Push Chart to OCI Registry
67+
id: oci-push
68+
run: |
69+
echo "Pushing Helm Chart to OCI Registry..."
70+
71+
PUSH_OUTPUT=$(helm push ${{ steps.package.outputs.CHART_PACKAGE }} "oci://${{ secrets.HELM_REGISTRY }}/${{ secrets.HELM_REPOSITORY }}" 2>&1)
72+
echo "$PUSH_OUTPUT"
73+
74+
# Extract digest from output (format: "Digest: sha256:...")
75+
DIGEST=$(echo "$PUSH_OUTPUT" | awk '/Digest:/ {print $2}')
76+
77+
# Construct the full OCI reference
78+
OCI_REFERENCE="${{ secrets.HELM_REGISTRY }}/${{ secrets.HELM_REPOSITORY }}/${{ github.event.client_payload.chart_name }}:${{ github.event.client_payload.chart_version }}"
79+
echo "OCI_REFERENCE=$OCI_REFERENCE" >> $GITHUB_OUTPUT
80+
echo "DIGEST=$DIGEST" >> $GITHUB_OUTPUT
81+
echo "Chart Pushed: $OCI_REFERENCE"
82+
83+
- name: Sign Chart with Cosign (Keyless)
84+
id: sign
85+
env:
86+
COSIGN_EXPERIMENTAL: "1"
87+
run: |
88+
echo "Signing chart with Sigstore/Cosign (keyless)..."
89+
# Sign the chart using keyless signing with OIDC
90+
cosign sign --yes ${{ steps.oci-push.outputs.OCI_REFERENCE }}
91+
echo "Chart Signed: ${{ steps.oci-push.outputs.OCI_REFERENCE }}"
92+
93+
- name: Verify Chart Signature
94+
env:
95+
COSIGN_EXPERIMENTAL: "1"
96+
run: |
97+
echo "Verifying Chart Signature..."
98+
cosign verify \
99+
--certificate-identity-regexp="https://github.com/${{ github.repository }}" \
100+
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
101+
${{ steps.oci-push.outputs.OCI_REFERENCE }}
102+
echo "Chart Signature Verified"
103+
104+
- name: Generate Attestation
105+
id: attest
106+
uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
107+
with:
108+
subject-name: ${{ secrets.HELM_REGISTRY }}/${{ secrets.HELM_REPOSITORY }}/${{ github.event.client_payload.chart_name }}
109+
subject-digest: ${{ steps.oci-push.outputs.DIGEST }}
110+
push-to-registry: true
111+
112+
- name: Verify Attestation
113+
run: |
114+
echo "Verifying Attestation..."
115+
gh auth login --with-token <<< '${{ secrets.GITHUB_TOKEN }}'
116+
gh attestation verify oci://${{ steps.oci-push.outputs.OCI_REFERENCE }} --owner ${{ github.repository_owner }}
117+
echo "Attestation Verified"
118+
119+
- name: Helm Chart Mueseum Push
120+
id: chartrepo-push
121+
run: |
122+
helm plugin install https://github.com/chartmuseum/helm-push
123+
echo "Pushing Helm Chart to ChartMuseum..."
124+
helm cm-push \
125+
--username '${{ secrets.HELM_USERNAME }}' \
126+
--password '${{ secrets.HELM_PASSWORD }}' \
127+
${{ steps.package.outputs.CHART_PACKAGE }} \
128+
"https://${{ secrets.HELM_REGISTRY }}/chartrepo/${{ secrets.HELM_REPOSITORY }}"
129+
echo "Helm Chart pushed to Chart Museum"
130+
131+
- name: Create Release Notes
132+
run: |
133+
CHART_NAME="${{ github.event.client_payload.chart_name }}"
134+
CHART_VERSION="${{ github.event.client_payload.chart_version }}"
135+
TAG_NAME="${{ github.event.client_payload.tag_name }}"
136+
SHA="${{ github.event.client_payload.sha }}"
137+
OCI_REFERENCE="${{ steps.oci-push.outputs.OCI_REFERENCE }}"
138+
REGISTRY="${{ secrets.HELM_REGISTRY }}"
139+
REPOSITORY="${{ secrets.HELM_REPOSITORY }}"
140+
141+
{
142+
echo ""
143+
echo "### OCI Registry Location"
144+
echo ""
145+
echo '```'
146+
echo "${OCI_REFERENCE}"
147+
echo '```'
148+
echo ""
149+
echo "### Installation"
150+
echo ""
151+
echo "Pull and install the chart using Helm:"
152+
echo ""
153+
echo '```bash'
154+
echo "# Pull the chart"
155+
echo "helm pull oci://${REGISTRY}/${REPOSITORY}/${CHART_NAME} --version ${CHART_VERSION}"
156+
echo ""
157+
echo "# Install the chart"
158+
echo "helm install ${CHART_NAME} oci://${REGISTRY}/${REPOSITORY}/${CHART_NAME} --version ${CHART_VERSION}"
159+
echo '```'
160+
echo ""
161+
echo "### Security & Verification"
162+
echo ""
163+
echo "#### Keyless Signature Verification"
164+
echo ""
165+
echo "This chart has been signed using **Sigstore/Cosign Keyless Signing**. Verify the signature:"
166+
echo ""
167+
echo '```bash'
168+
echo "# Install Cosign"
169+
echo "brew install cosign"
170+
echo ""
171+
echo "# Set experimental mode for keyless verification"
172+
echo "export COSIGN_EXPERIMENTAL=1"
173+
echo ""
174+
echo "# Verify the signature"
175+
echo "cosign verify \\"
176+
echo " --certificate-identity-regexp=\"https://github.com/${{ github.repository }}\" \\"
177+
echo " --certificate-oidc-issuer=\"https://token.actions.githubusercontent.com\" \\"
178+
echo " ${OCI_REFERENCE}"
179+
echo '```'
180+
echo ""
181+
echo "#### GitHub Attestation"
182+
echo ""
183+
echo "This chart includes a GitHub attestation for build provenance. You can verify it using:"
184+
echo ""
185+
echo '```bash'
186+
echo "gh attestation verify oci://${OCI_REFERENCE} --owner ${{ github.repository_owner }}"
187+
echo '```'
188+
} > release-notes.md
189+
190+
echo "Release Notes Generated"
191+
192+
- name: Append Release Notes to GitHub Release
193+
env:
194+
GH_TOKEN: ${{ github.token }}
195+
run: |
196+
TAG_NAME="${{ github.event.client_payload.tag_name }}"
197+
198+
echo "Appending release notes to release: $TAG_NAME"
199+
200+
# Get the current release notes
201+
CURRENT_NOTES=$(gh release view "$TAG_NAME" --json body --jq '.body')
202+
203+
# Read the new release notes
204+
NEW_NOTES=$(cat release-notes.md)
205+
206+
# Combine current notes with new notes (separated by a horizontal rule)
207+
COMBINED_NOTES=$(cat <<EOF
208+
${CURRENT_NOTES}
209+
210+
${NEW_NOTES}
211+
EOF
212+
)
213+
214+
# Update the release with combined notes
215+
gh release edit "$TAG_NAME" --notes "$COMBINED_NOTES"
216+
217+
echo "Release notes appended successfully"
218+
219+
- name: Summary
220+
run: |
221+
TAG_NAME="${{ github.event.client_payload.tag_name }}"
222+
223+
echo "## 🎉 Helm Chart Published Successfully" >> $GITHUB_STEP_SUMMARY
224+
echo "" >> $GITHUB_STEP_SUMMARY
225+
echo "**Chart:** ${{ github.event.client_payload.chart_name }}" >> $GITHUB_STEP_SUMMARY
226+
echo "**Version:** ${{ github.event.client_payload.chart_version }}" >> $GITHUB_STEP_SUMMARY
227+
echo "**Release:** [$TAG_NAME](https://github.com/${{ github.repository }}/releases/tag/$TAG_NAME)" >> $GITHUB_STEP_SUMMARY
228+
echo "**OCI Reference:** \`${{ steps.oci-push.outputs.OCI_REFERENCE }}\`" >> $GITHUB_STEP_SUMMARY
229+
echo "" >> $GITHUB_STEP_SUMMARY
230+
echo "### ✅ Completed Steps" >> $GITHUB_STEP_SUMMARY
231+
echo "- Packaged Helm chart" >> $GITHUB_STEP_SUMMARY
232+
echo "- Pushed to OCI registry" >> $GITHUB_STEP_SUMMARY
233+
echo "- Signed with Sigstore/Cosign (keyless)" >> $GITHUB_STEP_SUMMARY
234+
echo "- Verified signature" >> $GITHUB_STEP_SUMMARY
235+
echo "- Generated GitHub attestation" >> $GITHUB_STEP_SUMMARY
236+
echo "- Appended release notes to GitHub release" >> $GITHUB_STEP_SUMMARY
237+
echo "" >> $GITHUB_STEP_SUMMARY
238+
echo "### 🔐 Security" >> $GITHUB_STEP_SUMMARY
239+
echo "This chart is signed using **keyless signing** with Sigstore/Cosign." >> $GITHUB_STEP_SUMMARY
240+
echo "No private keys were used - authentication via OIDC." >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)