ci-helm.yml

# We have a dedicated CI workflow for our Helm charts because
# we only want to run the CI when the chart changes, not the app.
name: Continuous Integration of Helm Charts

on:
  workflow_call:

permissions:
  # Needed to read the contents of the repository
  contents: read
  # Needed to push the Helm chart to the GHCR
  packages: write

jobs:
  helm:
    name: Build, lint & push helm chart
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # We're fetching the tags explicitly because the checkout action's `fetch-tags` option
      # doesn't work -> https://github.com/actions/checkout/issues/1467
      - name: Fetch tags
        run: git fetch --tags

      - name: Get App Version
        id: appVersion
        run: echo "value=commit-$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Get Chart Version
        id: chartVersion
        # Generates a tag like: 0.1.0-commit-1234567
        run: |
          base="-commit-$(git rev-parse --short HEAD)"
          if [ -z "$(git tag --sort=taggerdate | tail -1)" ]; then
            echo "No tags found, using local chart version."
            echo "value=$(helm show chart ./chart | grep version | awk '{print $2}')${base}" >> $GITHUB_OUTPUT
          else
            echo "value=$(git tag --sort=taggerdate | tail -1 | cut -c 2-)${base}" >> $GITHUB_OUTPUT
          fi

      - name: Setup Helm
        run: |
          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
          helm version

      - name: Login to GHCR
        run: |
          helm registry login ghcr.io -u ${{ github.repository_owner }} -p ${{ secrets.GITHUB_TOKEN }}

      - name: Helm lint
        run: helm lint ./chart

      - name: Helm package
        run: helm package ./chart -d ./chart --version ${{ steps.chartVersion.outputs.value }} --app-version ${{ steps.appVersion.outputs.value }}

      - name: Push helm package
        run: |
          helm push $(ls ./chart/*.tgz| head -1) oci://ghcr.io/${{ github.repository_owner }}/charts

      # TODO: Sign the chart package