action.yaml

---
name: Publish Helm Chart
description: This action creates, publishes, and signs a Helm Chart
inputs:
  chart-registry-uri:
    description: The URI of the Helm Chart registry
    required: true
  chart-registry-username:
    description: The username used to login to the Helm Chart registry
    required: true
  chart-registry-password:
    description: The password used to login to the Helm Chart registry
    required: true
  chart-repository:
    description: Path to the Helm chart, for example `sdp-charts`
    required: true
  helm-version:
    description: Version of helm
    # See https://github.com/helm/helm/releases for latest version
    default: v3.21.1
  chart-version:
    description: The Helm Chart version
    required: true
  chart-directory:
    description: The directory where the Chart.yaml file is located
    required: true
  app-version:
    description: The app version to set in the Helm Chart
    required: true
  cosign-retries:
    description: The number of times cosign operations should be retried
    default: "3"
  cosign-retry-timeout:
    description: |
      Duration to wait before a new cosign operation is retried, format: `NUMBER[SUFFIX]`.
      SUFFIX may be 's' for seconds (the default), 'm' for minutes, 'h' for hours or 'd' for days.
      See `sleep --help` for the full details.
    default: "30s"
  publish-and-sign:
    description: Whether to publish and sign the packaged Helm Chart. Can be "true" or "false"
    default: "true"
  merge-registry-values:
    description: |
      Whether to merge a registry specific values.yaml file with the common one. Can be "true" or
      "false". The naming convention is as follows: `{chart-directory}/values/{chart-registry-uri}.yaml`
    default: "true"

runs:
  using: composite
  steps:
    - name: Set up Cosign
      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

    - name: Set up Helm
      env:
        HELM_VERSION: ${{ inputs.helm-version }}
        VERIFY_SIGNATURE: "false"
      shell: bash
      run: "$GITHUB_ACTION_PATH/../.scripts/actions/install_helm.sh"

    - name: Log into Container Registry (${{ inputs.chart-registry-uri }}) using Helm
      if: inputs.publish-and-sign == 'true'
      env:
        CHART_REGISTRY_USERNAME: ${{ inputs.chart-registry-username }}
        CHART_REGISTRY_PASSWORD: ${{ inputs.chart-registry-password }}
        CHART_REGISTRY_URI: ${{ inputs.chart-registry-uri }}
      shell: bash
      run: |
        set -euo pipefail
        [ -n "${RUNNER_DEBUG+set}" ] && set -x

        helm registry login --username "$CHART_REGISTRY_USERNAME" --password "$CHART_REGISTRY_PASSWORD" "$CHART_REGISTRY_URI"

    - name: Log into Container Registry (${{ inputs.chart-registry-uri }}) using Docker
      if: inputs.publish-and-sign == 'true'
      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
      with:
        registry: ${{ inputs.chart-registry-uri }}
        username: ${{ inputs.chart-registry-username }}
        password: ${{ inputs.chart-registry-password }}

    - name: Merge publish target specific values.yaml files
      if: inputs.merge-registry-values == 'true'
      env:
        CHART_REGISTRY_URI: ${{ inputs.chart-registry-uri }}
        CHART_DIRECTORY: ${{ inputs.chart-directory }}
      shell: bash
      run: |
        set -euo pipefail
        [ -n "${RUNNER_DEBUG+set}" ] && set -x

        # This is directly taken from the official yq examples and merges all
        # listed files. ORDER MATTERS. Later files are merged into earlier files.
        yq eval-all '. as $item ireduce ({}; . * $item )' \
          "$CHART_DIRECTORY/values.yaml" \
          "$CHART_DIRECTORY/values/${CHART_REGISTRY_URI}.yaml" \
          > "$CHART_DIRECTORY/values.merged.yaml"

        mv "$CHART_DIRECTORY/values.merged.yaml" "$CHART_DIRECTORY/values.yaml"

    - name: Package Helm Chart
      id: package
      env:
        CHART_DIRECTORY: ${{ inputs.chart-directory }}
        CHART_VERSION: ${{ inputs.chart-version }}
        APP_VERSION: ${{ inputs.app-version }}
      shell: bash
      run: |
        set -euo pipefail
        [ -n "${RUNNER_DEBUG+set}" ] && set -x

        # Create temporary directory to store the Helm Chart
        TEMP_CHART_DIR=$(mktemp -d)
        echo "TEMP_CHART_DIR=$TEMP_CHART_DIR" | tee -a "$GITHUB_OUTPUT"

        # Package the Helm Chart
        helm package \
          --destination "$TEMP_CHART_DIR" \
          --version "$CHART_VERSION" \
          --app-version "$APP_VERSION" \
          "$CHART_DIRECTORY"

    - name: Publish Helm Chart
      id: publish
      if: inputs.publish-and-sign == 'true'
      env:
        TEMP_CHART_DIR: ${{ steps.package.outputs.TEMP_CHART_DIR }}
        CHART_REGISTRY_URI: ${{ inputs.chart-registry-uri }}
        CHART_REPOSITORY: ${{ inputs.chart-repository }}
        CHART_DIRECTORY: ${{ inputs.chart-directory }}
        CHART_VERSION: ${{ inputs.chart-version }}
      shell: bash
      run: |
        set -euo pipefail
        [ -n "${RUNNER_DEBUG+set}" ] && set -x

        CHART_NAME=$(echo "$CHART_DIRECTORY" | awk -F/ '{print $NF}')
        CHART_ARTIFACT="${TEMP_CHART_DIR}/${CHART_NAME}-${CHART_VERSION}.tgz"
        echo "CHART_NAME=$CHART_NAME" | tee -a "$GITHUB_OUTPUT"

        # Capture the stdout output to extract the digest. It is sad that Helm doesn't provide
        # structured output, eg. in JSON. There is a 2-year old open issue about it:
        # https://github.com/helm/helm/issues/11735
        HELM_OUTPUT=$(helm push "$CHART_ARTIFACT" "oci://${CHART_REGISTRY_URI}/${CHART_REPOSITORY}" 2>&1)

        # Yuck
        CHART_DIGEST=$(echo "$HELM_OUTPUT" | awk '/^Digest: sha256:[0-9a-f]{64}$/ { print $2 }')

        if [ -z "$CHART_DIGEST" ]; then
          echo "Could not find digest of Helm Chart"
          exit 1
        fi

        echo "CHART_DIGEST=$CHART_DIGEST" | tee -a "$GITHUB_OUTPUT"

    - name: Sign Helm Chart
      if: inputs.publish-and-sign == 'true'
      env:
        RETRY_TIMEOUT: ${{ inputs.cosign-retry-timeout }}
        RETRY_COUNT: ${{ inputs.cosign-retries }}
        RETRY_ARGS: --verbose
        CHART_DIGEST: ${{ steps.publish.outputs.CHART_DIGEST }}
        CHART_REGISTRY_URI: ${{ inputs.chart-registry-uri }}
        CHART_NAME: ${{ steps.publish.outputs.CHART_NAME }}
        CHART_REPOSITORY: ${{ inputs.chart-repository }}
      shell: bash
      run: |
        set -euo pipefail
        [ -n "${RUNNER_DEBUG+set}" ] && set -x

        # This generates a signature and publishes it to the registry, next to the chart artifact
        # Uses the keyless signing flow with Github Actions as identity provider
        cosign sign --yes "${CHART_REGISTRY_URI}/${CHART_REPOSITORY}/${CHART_NAME}@${CHART_DIGEST}"