publish-helm-chart.yaml

name: Publish production-stack helm charts

# Reusable workflow. Invoked by create-release.yaml after the image has been
# published. Stages the releasable charts and pushes them to gh-pages under
# charts/kaito-project/.
on:
  workflow_call:
    inputs:
      release_version:
        description: 'tag of the release whose charts should be published (i.e. vX.Y.Z)'
        required: true
        type: string

permissions:
  id-token: write
  packages: write
  contents: write
  actions: read
  deployments: read
  pull-requests: read

jobs:
  push-charts-to-ghp:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
          disable-sudo: true
          disable-telemetry: true

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: true
          fetch-depth: 0
          ref: ${{ inputs.release_version }}

      - name: Stage charts for publishing
        # Copy each releasable chart into a clean staging dir so that any
        # in-tree dev-only Helm folders (added later) are not picked up by
        # helm-gh-pages. Add new charts here when they need to be published.
        run: |
          mkdir -p packaged-charts
          cp -r charts/gpu-node-mocker packaged-charts/
          cp -r charts/modeldeployment packaged-charts/
          cp -r charts/modelharness    packaged-charts/

      - name: Publish helm charts to gh-pages
        uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          charts_dir: packaged-charts
          target_dir: charts/kaito-project
          linting: off

  push-charts-to-mcr:
    runs-on:
      labels:
        - self-hosted
        - 1ES.Pool=1es-aks-kaito-agent-pool-ubuntu
        - JobId=pushChartsToMcr-${{ strategy.job-index }}-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.release_version }}
      - name: Setup Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
        with:
          version: v3.20.2
      - name: ACR Login
        run: |
          az login --identity
          az acr login -n '${{ secrets.MCR_REGISTRY }}'
      - name: Push Charts
        run: |
          export CHART_REGISTRY='${{ secrets.MCR_REGISTRY }}.azurecr.io/public/aks/kaito/helm'
          export CHART_VERSION="$(sed -e 's/^v//g' <<< '${{ inputs.release_version }}')"
          make helm-package-and-push CHART_NAME='gpu-node-mocker'
          make helm-package-and-push CHART_NAME='modeldeployment'
          make helm-package-and-push CHART_NAME='modelharness'