ci: release-on-upstream — publish the new busbar version automaticall… #13

	name: Release Charts

	on:
	push:
	branches:
	- main

	permissions:
	contents: write
	pages: write
	id-token: write # OIDC identity for keyless Sigstore provenance
	attestations: write # record the build-provenance attestation

	jobs:
	release:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Configure Git
	run: \|
	git config user.name "$GITHUB_ACTOR"
	git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

	- name: Set up Helm
	uses: azure/setup-helm@v4
	with:
	version: v3.16.3

	- name: Run chart-releaser
	uses: helm/chart-releaser-action@v1.7.0
	with:
	charts_dir: charts
	env:
	CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

	# chart-releaser packages newly-versioned charts into .cr-release-packages and
	# uploads each .tgz to its GitHub Release. Only attest when something was packaged
	# (a no-op push leaves the dir empty; attesting nothing would fail the job).
	- name: Detect packaged charts
	id: pkg
	run: \|
	if ls .cr-release-packages/*.tgz >/dev/null 2>&1; then
	echo "packaged=true" >> "$GITHUB_OUTPUT"
	else
	echo "no charts packaged this run; skipping attestation"
	fi

	# Keyless Sigstore build-provenance binding each chart .tgz digest to this workflow
	# run + commit. A user verifies a downloaded chart with:
	# gh attestation verify busbar-<ver>.tgz --repo GetBusbar/helm-charts
	- name: Attest chart provenance
	if: steps.pkg.outputs.packaged == 'true'
	uses: actions/attest-build-provenance@v4
	with:
	subject-path: ".cr-release-packages/*.tgz"

Navigation Menu