helm-workflows.yml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Helm Charts

on:
  workflow_call:
    inputs:
      app_version:
        description: "Application version for Helm chart appVersion"
        required: true
        type: string
    secrets:
      NVCR_STG_TOKEN:
        required: true

jobs:
  # Detect per-chart changes
  detect-changes:
    name: Detect Helm Chart Changes
    runs-on: ubuntu-latest
    outputs:
      any_changed: ${{ steps.changes.outputs.any_changed }}
      carbide_rest_changed: ${{ steps.changes.outputs.carbide_rest }}
      site_agent_changed: ${{ steps.changes.outputs.site_agent }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Check for helm/ changes
        uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
            any_changed:
              - 'helm/**'
            carbide_rest:
              - 'helm/charts/carbide-rest/**'
            site_agent:
              - 'helm/charts/carbide-rest-site-agent/**'

  # Validate Chart.yaml versions are bumped (PR branches only)
  validate-versions:
    name: Validate Helm Chart Versions
    needs:
      - detect-changes
    if: ${{ needs.detect-changes.outputs.any_changed == 'true' && contains(github.ref, 'pull-request/') }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Verify Chart.yaml versions are updated
        run: |
          FAILED=false
          check_version() {
            local chart_dir="$1" changed="$2"
            if [ "$changed" != "true" ]; then
              echo "⊘ ${chart_dir}: no changes, skipping version check"
              return
            fi
            local chart_yaml="${chart_dir}/Chart.yaml"
            local current_version=$(grep '^version:' "$chart_yaml" | awk '{print $2}')
            local base_version=$(git show origin/main:"$chart_yaml" 2>/dev/null | grep '^version:' | awk '{print $2}' || echo "")
            if [ -n "$base_version" ] && [ "$current_version" = "$base_version" ]; then
              echo "::error file=${chart_yaml}::Chart version ($current_version) was not updated. Please bump the version in $chart_yaml"
              FAILED=true
            else
              echo "✓ ${chart_dir}: version updated to $current_version"
            fi
          }
          check_version "helm/charts/carbide-rest" "${{ needs.detect-changes.outputs.carbide_rest_changed }}"
          check_version "helm/charts/carbide-rest-site-agent" "${{ needs.detect-changes.outputs.site_agent_changed }}"
          if [ "$FAILED" = "true" ]; then
            exit 1
          fi

  # Lint and template validation
  validate-charts:
    name: Validate Helm Charts
    needs:
      - detect-changes
      - validate-versions
    if: ${{ always() && needs.detect-changes.outputs.any_changed == 'true' && (needs.validate-versions.result == 'success' || needs.validate-versions.result == 'skipped') }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - chart: helm/charts/carbide-rest
            valueOverrides: '["carbide-rest-api.config.keycloak.enabled=true","carbide-rest-api.config.keycloak.baseURL=http://keycloak:8082","carbide-rest-api.config.keycloak.realm=test","carbide-rest-api.config.keycloak.clientID=test"]'
          - chart: helm/charts/carbide-rest-site-agent
            valueOverrides: '[]'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Validate Helm chart
        uses: NVIDIA/dsx-github-actions/.github/actions/helm-validate@94bde998f5d7965576b0c663db7d5d709c918167
        with:
          chart-path: ${{ matrix.chart }}
          lint: 'true'
          template: 'true'
          valueOverrides: ${{ matrix.valueOverrides }}

  # Package and push to NGC (main branch only)
  push-charts:
    name: Push Helm Charts
    needs:
      - detect-changes
      - validate-charts
    if: ${{ !cancelled() && needs.detect-changes.outputs.any_changed == 'true' && needs.validate-charts.result == 'success' && github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        chart:
          - helm/charts/carbide-rest
          - helm/charts/carbide-rest-site-agent
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Read chart version from Chart.yaml
        id: chart-version
        run: |
          VERSION=$(grep '^version:' ${{ matrix.chart }}/Chart.yaml | awk '{print $2}')
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Package and push Helm chart to NGC
        uses: NVIDIA/dsx-github-actions/.github/actions/helm-package-push@94bde998f5d7965576b0c663db7d5d709c918167
        with:
          chart-path: ${{ matrix.chart }}
          chart-version: ${{ steps.chart-version.outputs.version }}
          app-version: ${{ inputs.app_version }}
          lint: 'false'
          ngc-key: ${{ secrets.NVCR_STG_TOKEN }}
          ngc-path: 0837451325059433/carbide-dev
          ngc-duplicate: fail