release-helm.yml

---
name: Release Helm

on:
  workflow_call:
    inputs:
      tag_name:
        description: "Helm release tag (e.g., github-sts-chart-v1.2.3)"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag_name:
        description: "Helm release tag (e.g., github-sts-chart-v1.2.3)"
        required: true
        type: string

permissions: {}

jobs:
  helm:
    name: Publish Helm Chart
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
    env:
      CHART_DIR: charts/github-sts
      TAG_NAME: ${{ inputs.tag_name || github.ref_name }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ env.TAG_NAME }}
          persist-credentials: false

      - name: Set up Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1

      - name: Install cosign
        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0

      - name: Log in to GHCR
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get chart info
        id: chart_info
        run: |
          CHART_NAME=$(helm show chart "${CHART_DIR}" | grep '^name:' | cut -d' ' -f2)
          CHART_VERSION=$(helm show chart "${CHART_DIR}" | grep '^version:' | awk '{print $2}')

          if [ -z "$CHART_NAME" ] || [ -z "$CHART_VERSION" ]; then
            echo "Failed to extract chart information."
            exit 1
          fi

          LOWERCASE_OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
          echo "oci_registry=${LOWERCASE_OWNER}" >> "$GITHUB_OUTPUT"
          echo "chart_name=${CHART_NAME}" >> "$GITHUB_OUTPUT"
          echo "chart_version=${CHART_VERSION}" >> "$GITHUB_OUTPUT"

          echo "Chart: ${CHART_NAME}"
          echo "Chart Version: ${CHART_VERSION}"

      - name: Verify version consistency
        run: |
          TAG="${{ env.TAG_NAME }}"
          if [[ "$TAG" == *-v* ]]; then
            TAG_VERSION="${TAG##*-v}"
          else
            TAG_VERSION="${TAG#v}"
          fi

          if [ "${{ steps.chart_info.outputs.chart_version }}" != "${TAG_VERSION}" ]; then
            echo "Version mismatch!"
            echo "  Chart.yaml version: ${{ steps.chart_info.outputs.chart_version }}"
            echo "  Tag version: ${TAG_VERSION}"
            exit 1
          else
            echo "Version consistency verified: ${TAG_VERSION}"
          fi

      - name: Package and publish chart
        id: publish
        run: |
          echo "Adding Helm dependencies..."
          helm dependency update "${CHART_DIR}"

          echo "Packaging Helm chart..."
          helm package "${CHART_DIR}"
          CHART_PACKAGE="${{ steps.chart_info.outputs.chart_name }}-${{ steps.chart_info.outputs.chart_version }}.tgz"

          if [ ! -f "$CHART_PACKAGE" ]; then
            echo "Chart package not found: $CHART_PACKAGE"
            exit 1
          fi

          echo "chart_package_path=${CHART_PACKAGE}" >> "$GITHUB_OUTPUT"
          echo "Chart packaged: ${CHART_PACKAGE}"

          OCI_URL="oci://ghcr.io/${{ steps.chart_info.outputs.oci_registry }}"
          echo "Pushing to ${OCI_URL}"

          helm_push_output=$(helm push "$CHART_PACKAGE" "$OCI_URL" 2>&1)

          echo "Fetching digest information..."
          echo "$helm_push_output"
          DIGEST=$(echo "$helm_push_output" | grep -o 'sha256:[a-z0-9]*')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Chart published to ghcr.io/${{ steps.chart_info.outputs.oci_registry }}/${{ steps.chart_info.outputs.chart_name }}:${{ steps.chart_info.outputs.chart_version }}"

      - name: Sign chart with cosign
        run: |
          CHART_REF="ghcr.io/${{ steps.chart_info.outputs.oci_registry }}/${{ steps.chart_info.outputs.chart_name }}@${{ steps.publish.outputs.digest }}"
          echo "Signing: ${CHART_REF}"
          cosign sign --yes "$CHART_REF"
          echo "Chart signed successfully"

      - name: Generate build attestation
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
        with:
          subject-name: "ghcr.io/${{ steps.chart_info.outputs.oci_registry }}/${{ steps.chart_info.outputs.chart_name }}"
          subject-digest: ${{ steps.publish.outputs.digest }}
          push-to-registry: true

      - name: Upload chart to release
        uses: softprops/action-gh-release@62c96d0c4e8a889135c1f3a25910db8dbe0e85f7 # v2.3.4
        if: github.ref_type == 'tag'
        with:
          tag_name: ${{ env.TAG_NAME }}
          files: |
            ${{ steps.publish.outputs.chart_package_path }}

      - name: Create success summary
        run: |
          echo "## Chart Released Successfully!" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "**Chart:** ${{ steps.chart_info.outputs.chart_name }}" >> "$GITHUB_STEP_SUMMARY"
          echo "**Version:** ${{ steps.chart_info.outputs.chart_version }}" >> "$GITHUB_STEP_SUMMARY"
          echo "**Registry:** ghcr.io/${{ steps.chart_info.outputs.oci_registry }}/${{ steps.chart_info.outputs.chart_name }}" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "### Installation" >> "$GITHUB_STEP_SUMMARY"
          echo '```bash' >> "$GITHUB_STEP_SUMMARY"
          echo "helm install my-release oci://ghcr.io/${{ steps.chart_info.outputs.oci_registry }}/${{ steps.chart_info.outputs.chart_name }} --version ${{ steps.chart_info.outputs.chart_version }}" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "### Verification" >> "$GITHUB_STEP_SUMMARY"
          echo '```bash' >> "$GITHUB_STEP_SUMMARY"
          echo "cosign verify ghcr.io/${{ steps.chart_info.outputs.oci_registry }}/${{ steps.chart_info.outputs.chart_name }}:${{ steps.publish.outputs.digest }}" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"