Skip to content

feat: add chart signing #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bpsoraggi wants to merge 2 commits into
base: master
Choose a base branch
from
Open

feat: add chart signing #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9742b71
feat: add chart signing
bpsoraggi Jul 30, 2025
2a2569e
chore: fix error with keys whose names contain spaces
bpsoraggi Jul 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
FROM stefanprodan/alpine-base:latest

RUN apk --no-cache add git
RUN apk --no-cache add git gnupg

COPY src/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
Expand Down
12 changes: 12 additions & 0 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,15 @@ inputs:
dependencies:
description: "A list of helm repositories required to verify dependencies in the format '<name>,<url>;<name>,<url>'"
required: false
key:
description: "The GPG key to sign the chart with"
required: false
private_key:
description: "The private GPG key to sign the chart with"
required: false
passphrase:
description: "The passphrase for the private GPG key"
required: false
runs:
using: 'docker'
image: 'Dockerfile'
Expand All @@ -75,3 +84,6 @@ runs:
- ${{ inputs.index_dir }}
- ${{ inputs.enterprise_url }}
- ${{ inputs.dependencies }}
- ${{ inputs.key }}
- ${{ inputs.private_key }}
- ${{ inputs.passphrase }}
14 changes: 13 additions & 1 deletion src/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ CHART_VERSION=${13}
INDEX_DIR=${14}
ENTERPRISE_URL=${15}
DEPENDENCIES=${16}
KEY=${17}
PRIVATE_KEY=${18}
PASSPHRASE=${19}

CHARTS=()
CHARTS_TMP_DIR=$(mktemp -d)
Expand Down Expand Up @@ -163,7 +166,14 @@ package() {
CHART_VERSION_CMD=" --version $CHART_VERSION"
fi

helm package ${CHARTS[*]} --destination ${CHARTS_TMP_DIR} $APP_VERSION_CMD$CHART_VERSION_CMD
if [[ ! -z "$KEY" ]]; then
echo "$PRIVATE_KEY" | gpg --batch --import
gpg --batch --pinentry-mode loopback --yes --passphrase "$PASSPHRASE" --export-secret-key > $HOME/secring.gpg
echo "$PASSPHRASE" > $HOME/passphrase.txt
SIGN_CMD=" --sign --key '"$KEY"' --keyring $HOME/secring.gpg --passphrase-file $HOME/passphrase.txt"
fi

eval helm package ${CHARTS[*]} --destination ${CHARTS_TMP_DIR} $SIGN_CMD$APP_VERSION_CMD$CHART_VERSION_CMD
}

upload() {
Expand All @@ -186,11 +196,13 @@ upload() {
echo "Found index, merging changes"
helm repo index ${CHARTS_TMP_DIR} --url ${CHARTS_URL} --merge "${INDEX_DIR}/index.yaml"
mv -f ${CHARTS_TMP_DIR}/*.tgz ${TARGET_DIR}
mv -f ${CHARTS_TMP_DIR}/*.prov ${TARGET_DIR} 2>/dev/null || true
mv -f ${CHARTS_TMP_DIR}/index.yaml ${INDEX_DIR}/index.yaml
else
echo "No index found, generating a new one"
helm repo index ${CHARTS_TMP_DIR} --url ${CHARTS_URL}
mv -f ${CHARTS_TMP_DIR}/*.tgz ${TARGET_DIR}
mv -f ${CHARTS_TMP_DIR}/*.prov ${TARGET_DIR} 2>/dev/null || true
mv -f ${CHARTS_TMP_DIR}/index.yaml ${INDEX_DIR}
fi

Expand Down