helm-publish.yml

name: Helm publish

# Tag-based Helm chart release. Pushing a semver tag packages
# charts/etcd-operator and pushes it as an OCI chart to GHCR under the org's
# charts repo (ghcr.io/<owner>/charts/etcd-operator), versioned from the tag.
# Same shape as the legacy v1alpha1 helm-publish, retargeted at this org and
# using the built-in GITHUB_TOKEN.
on:
  push:
    tags: [ 'v*.*.*' ]

env:
  REGISTRY: ghcr.io
  CHARTS_REPOSITORY: ${{ github.repository_owner }}/charts
  CHART_NAME: etcd-operator

jobs:
  build:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # make manifests regenerates the CRDs and manager RBAC rules (controller-gen)
      # straight into the chart, so the published package always matches the
      # tagged API types and +kubebuilder:rbac markers — never a stale committed
      # copy. (ci.yml's drift gate already enforces this on PRs; this is belt-and-
      # suspenders at publish time.)
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Install Helm
        uses: azure/setup-helm@v4
        with:
          version: 'v3.16.4'

      - name: Regenerate CRDs and RBAC into the chart
        run: make manifests

      - name: Resolve chart versions from tag
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG="$REF_NAME"
          echo "RELEASE_TAG=${TAG}" >> "$GITHUB_ENV"
          # Chart version is semver without the leading v; appVersion keeps it.
          echo "RELEASE_TAG_TRIMMED_V=${TAG#v}" >> "$GITHUB_ENV"

      - name: Helm registry login
        env:
          ACTOR: ${{ github.actor }}
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          helm registry login \
            --username "$ACTOR" \
            --password "$TOKEN" \
            "${{ env.REGISTRY }}"

      - name: Package chart
        working-directory: charts
        run: |
          helm package "${{ env.CHART_NAME }}" \
            --version "${RELEASE_TAG_TRIMMED_V}" \
            --app-version "${RELEASE_TAG}"

      - name: Push chart
        working-directory: charts
        run: |
          helm push "${{ env.CHART_NAME }}-${RELEASE_TAG_TRIMMED_V}.tgz" \
            "oci://${{ env.REGISTRY }}/${{ env.CHARTS_REPOSITORY }}"