release.yml

name: Release Charts

on:
  push:
    branches:
      - main

jobs:
  release:
    permissions:
      contents: write
      packages: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Install Helm
        id: install
        uses: azure/setup-helm@v5
        env:
          GITHUB_TOKEN: ${{ github.token }}

      - name: Prepare chart signing key (Helm provenance)
        id: signing
        shell: bash
        env:
          GPG_KEYRING_BASE64: "${{ secrets.GPG_KEYRING_BASE64 }}"
          GPG_SIGNING_KEY: "${{ secrets.GPG_SIGNING_KEY }}"
        run: |
          set -euo pipefail
          if [[ -z "${GPG_KEYRING_BASE64:-}" || -z "${GPG_SIGNING_KEY:-}" ]]; then
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            echo "Chart signing key not configured; will refuse to release chart version bumps." >&2
            exit 0
          fi

          mkdir -p .cr-gpg
          echo "$GPG_KEYRING_BASE64" | base64 -d > .cr-gpg/private.key
          chmod 600 .cr-gpg/private.key

          # Import signing key into a dedicated GPG homedir so helm/cr can find the private key.
          GNUPGHOME="$PWD/.gnupg"
          mkdir -p "$GNUPGHOME"
          chmod 700 "$GNUPGHOME"
          gpg --batch --homedir "$GNUPGHOME" --import .cr-gpg/private.key

          {
            echo "CR_SIGN=true"
            echo "CR_KEY=$GPG_SIGNING_KEY"
            # cr/helm expects CR_KEYRING to point at a keyring that contains the secret key.
            # We use an exported secret key file produced by `gpg --export-secret-keys`.
            echo "CR_KEYRING=$PWD/.cr-gpg/private.key"
            echo "GNUPGHOME=$GNUPGHOME"
          } >> "$GITHUB_ENV"

          echo "enabled=true" >> "$GITHUB_OUTPUT"

      - name: Refuse unsigned chart releases
        if: ${{ steps.signing.outputs.enabled != 'true' }}
        shell: bash
        run: |
          set -euo pipefail
          if git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" | grep -Eq '^charts/[^/]+/Chart.yaml$'; then
            echo "Chart.yaml changed in this push, but signing is not configured. Aborting release." >&2
            exit 1
          fi

      - name: Run chart-releaser
        uses: helm/chart-releaser-action@v1
        with:
          version: v1.8.1
          skip_existing: true
        env:
          CR_TOKEN: ${{ github.token }}

      # Note: Removed extra cr index step to avoid merge conflicts with chart-releaser's own gh-pages updates.

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Push Charts to GHCR
        shell: bash
        run: |
          if [ -d ".cr-release-packages" ]; then
            shopt -s nullglob
            for pkg in .cr-release-packages/*.tgz; do
              helm push "${pkg}" "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts"
            done
          else
            echo "Directory .cr-release-packages does not exist."
          fi