publish-helm.yml

name: Publish Helm Chart

on:
  workflow_dispatch:
    inputs:
      branch:
        description: "Release Helm chart from branch"
        required: true
        type: string
      ic_version:
        description: "Ingress Controller version"
        required: true
        type: string
      chart_version:
        description: "Helm Chart version"
        required: true
        type: string
      chart_name:
        description: "Helm Chart name (default: nginx-ingress)"
        default: "nginx-ingress"
        type: string
      nginx_helm_repo:
        description: "Publish to the NGINX Helm repo"
        required: true
        type: boolean
      runner:
        description: "The runner to use for the workflow"
        default: "ubuntu-24.04"
        type: string
  workflow_call:
    inputs:
      branch:
        description: "Release Helm chart from branch"
        required: true
        type: string
      ic_version:
        description: "Ingress Controller version"
        required: true
        type: string
      chart_version:
        description: "Helm Chart version"
        required: true
        type: string
      chart_name:
        description: "Helm Chart name (default: nginx-ingress)"
        default: "nginx-ingress"
        type: string
      nginx_helm_repo:
        description: "Publish to the NGINX Helm repo"
        required: true
        type: boolean
      runner:
        description: "The runner to use for the workflow"
        default: "ubuntu-24.04"
        type: string

defaults:
  run:
    shell: bash

concurrency:
  group: ${{ github.ref_name }}-publish-helm
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  publish-helm:
    name: Package and Publish Helm Chart
    if: github.repository == 'nginx/kubernetes-ingress'
    runs-on: ${{ inputs.runner }}
    permissions:
      contents: write # for pushing to Helm Charts repository
      packages: write # for helm to push to GHCR
      id-token: write # for OIDC login
    steps:
      - name: Checkout Repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: refs/heads/${{ inputs.branch }}
          path: kic

      - name: Azure login
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }}

      - name: Get secrets from vault
        uses: nginx/ci-self-hosted/.github/actions/get-from-vault@5c3e1f8b51f66a851fdba80f70e19cf966199730 # main @ 2026-05-22
        with:
          vault-name: ${{ secrets.COMMON_KEYVAULT_NAME }}
          secret-names: "docker-username, docker-password, nginx-bot-helm-app-client-id, nginx-bot-helm-app-private-key"
          env-names: "DOCKER_USERNAME, DOCKER_PASSWORD, APP_CLIENT_ID, APP_PRIVATE_KEY_B64"

      - name: Login to GitHub Container Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: DockerHub Login
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ env.DOCKER_USERNAME }}
          password: ${{ env.DOCKER_PASSWORD }}

      - name: Setup Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v4.2.3 # renovate: datasource=github-releases depName=helm/helm

      - name: Package
        id: package
        run: |
          helm_versions="--app-version ${{ inputs.ic_version }} --version ${{ inputs.chart_version }}"
          chart_name="${{ inputs.chart_name }}"
          if [[ ! "$chart_name" =~ ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ ]]; then
            echo "Invalid chart_name: must match Helm chart name pattern ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$" >&2
            exit 1
          fi
          sed -i "s|^name:.*|name: ${chart_name}|" kic/charts/nginx-ingress/Chart.yaml
          if [[ "${{ inputs.ic_version }}" =~ ^20[0-9]+-lts ]]; then
            IMAGE_REPOSITORY="private-registry.nginx.com/lts/nginx-ic/nginx-plus-ingress"
            sed -i "s|^  nginxplus: false|  nginxplus: true|" kic/charts/nginx-ingress/values.yaml
            sed -E -i "s|^(    )repository:.*|\1repository: ${IMAGE_REPOSITORY}|" kic/charts/nginx-ingress/values.yaml
            sed -E -i "s|^(    )(# *)?tag:.*|\1tag: \"${{ inputs.ic_version }}\"|" kic/charts/nginx-ingress/values.yaml
          fi
          output=$(helm package ${helm_versions} kic/charts/nginx-ingress)
          echo "path=$(basename -- $(echo $output | cut -d: -f2))" >> $GITHUB_OUTPUT

      - name: Push to OCI registries
        run: |
          helm push ${{ steps.package.outputs.path }} oci://ghcr.io/nginx/charts
          helm push ${{ steps.package.outputs.path }} oci://registry-1.docker.io/nginxcharts

      - name: Decode GitHub App private key
        id: app_key
        run: |
          set +x
          # Mask the raw base64 value
          echo "::add-mask::$APP_PRIVATE_KEY_B64"
          private_key=$(printf '%s' "$APP_PRIVATE_KEY_B64" | base64 -d)
          # Mask every line of the decoded PEM key individually
          while IFS= read -r line; do
            if [[ -n "$line" ]]; then
              echo "::add-mask::$line"
            fi
          done <<< "$private_key"
          delimiter="GHEOF_$(openssl rand -hex 12)"
          {
            echo "private_key<<$delimiter"
            echo "$private_key"
            echo "$delimiter"
          } >> "$GITHUB_OUTPUT"
        if: ${{ inputs.nginx_helm_repo }}

      - name: Generate GitHub App token
        id: app_token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ env.APP_CLIENT_ID }}
          private-key: ${{ steps.app_key.outputs.private_key }}
          owner: nginxinc
          repositories: helm-charts
        if: ${{ inputs.nginx_helm_repo }}

      - name: Checkout Repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          repository: nginxinc/helm-charts
          fetch-depth: 1
          token: ${{ steps.app_token.outputs.token }}
          path: helm-charts
        if: ${{ inputs.nginx_helm_repo }}

      - name: Push Helm Chart to Helm Charts Repository
        run: |
          mv ${{ steps.package.outputs.path }} ${{ github.workspace }}/helm-charts/stable/
          cd ${{ github.workspace }}/helm-charts
          helm repo index stable --url https://helm.nginx.com/stable
          git add -A
          git -c user.name='NGINX Kubernetes Team' -c user.email='kubernetes@nginx.com' \
          commit -m "NGINX Ingress Controller - Release ${{ inputs.chart_version }}"
          git push -u origin master
        if: ${{ inputs.nginx_helm_repo }}