release.yml

name: Release Charts
on:
  push:
    branches: [master]
    paths:
      - charts/**
  workflow_dispatch:
jobs:
  release:
    permissions:
      contents: write # to push chart release and create a release (helm/chart-releaser-action)

    runs-on: ubuntu-latest
    steps:
      - name: Checkout HiveMQ Helm Charts
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Set up Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4

      - name: Set up JDK 21
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4
        with:
          distribution: temurin
          java-version: 21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4
        with:
          gradle-home-cache-includes: |
            caches
            notifications
            jdks

      - name: Add dependency chart repos
        run: |
          helm repo add prometheus-community https://prometheus-community.github.io/helm-charts

      - name: Prepare PGP keys for signing HiveMQ Helm charts
        run: |
          echo "${{ secrets.SIGNING_KEY }}" | gpg --dearmor > $HOME/secring.gpg
          echo "${{ secrets.SIGNING_PASSWORD }}" > $HOME/passphrase
          echo "CR_KEYRING=$HOME/secring.gpg" >> "$GITHUB_ENV"
          echo "CR_PASSPHRASE_FILE=$HOME/passphrase" >> "$GITHUB_ENV"

      - name: Run chart-releaser
        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
        with:
          config: .github/configs/chart-releaser.yml

      - name: Cleanup GPG files
        if: always() # ensures cleanup even if the previous step fails
        run: |
          rm -f $HOME/secring.gpg
          rm -f $HOME/passphrase

      - name: Set latest release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash ./scripts/set-latest-release.sh

      - name: Update GitHub release notes
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash ./scripts/update-github-release-notes.sh 10