helm-release.yaml

name: Package Helm Chart and publish to GitHub Packages

on:
  workflow_dispatch: {}
  push:
    branches:
        - main
    paths:
      - .github/workflows/helm-release.yaml
      - charts/heureka
      - scanner/k8s-assets/chart/k8s-assets-scanner
      - scanner/keppel/chart/keppel-scanner
      - scanner/nvd/chart/nvd-scanner


permissions:
  contents: write
  packages: write

env:
  REGISTRY: ghcr.io
  ACTIONS_RUNNER_DEBUG: false

jobs:
  helm-release:
    runs-on: [ default ]
    strategy:
      fail-fast: false
      matrix:
        include:
          - chartDir: charts/heureka
            chartName: heureka
          - chartDir: scanner/k8s-assets/chart/k8s-assets-scanner
            chartName: k8s-assets-scanner
          - chartDir: scanner/keppel/chart/keppel-scanner
            chartName: keppel-scanner
          - chartDir: scanner/nvd/chart/nvd-scanner
            chartName: nvd-scanner


    steps:
      - uses: actions/checkout@v4
        with:
            fetch-depth: 0
            token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Set up Helm
        uses: azure/setup-helm@v4.2.0

      - uses: actions/setup-python@v5
        with:
            python-version: 3.9
            check-latest: true
            token: ${{ secrets.GITHUB_TOKEN }}

      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
            registry: ${{ env.REGISTRY }}
            username: ${{ github.actor }}
            password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@v45
        with:
          files: |
            ${{ matrix.chartDir }}/**
    
      - name: Check if Helm chart with same version already exists
        id: check-chart
        if: steps.changed-files.outputs.all_changed_files != ''
        env:
          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
        run: |
          # List all changed
          echo "All changed files: $ALL_CHANGED_FILES"
          chartName=$(yq .name "${{ matrix.chartDir }}/Chart.yaml")
          chartVersion=$(yq .version "${{ matrix.chartDir }}/Chart.yaml")
          echo "chart_version=${chartVersion}" >> "$GITHUB_OUTPUT"
          if $(helm pull "oci://${{ env.REGISTRY }}/${{ github.repository }}/charts/${{ matrix.chartName }}" --version $chartVersion); then
            echo "bump=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Chart needs version bump
        if: steps.check-chart.outputs.bump == 'true'
        env:
          CHART_VERSION: ${{ steps.check-chart.outputs.chart_version }}
        run: |
          echo "Chart ${{ matrix.chartDir }}:${{ env.CHART_VERSION }} already exists in OCI registry. Skipping upload. Please increment the chart version."
          exit 1

      - name: Push Charts to GHCR
        if: steps.changed-files.outputs.all_changed_files != '' && steps.check-chart.outputs.bump != 'true'
        run: |
          helm package ${{ matrix.chartDir }} -d ${{ matrix.chartDir }}
          PKG_NAME=`ls ${{ matrix.chartDir }}/*.tgz`
          helm push ${PKG_NAME} oci://${{ env.REGISTRY }}/${{ github.repository }}/charts/