helm.yaml

name: Helm CI/CD

on:
  workflow_call:
    inputs:
      version:
        description: 'Version to deploy (e.g. v1.2.3)'
        type: string
        required: true
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
    paths:
      - ".github/workflows/helm.yaml"
      - "deploy/charts/**"

permissions:
  packages: write
  id-token: write # Required for keyless cosign signing

env:
  CHART_NAME: burrito
  CHART_PATH: ./deploy/charts/burrito
  CHART_REPO: ghcr.io/${{ github.repository_owner }}/charts

jobs:
  helm-render:
    name: Helm Render
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Helm Render
        run: helm template ${{ env.CHART_PATH }}

  helm-push:
    name: Helm Push
    runs-on: ubuntu-latest
    needs: helm-render
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: GHCR Login
        run: echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: Compute versions
        shell: bash
        run: |
          CURRENT_VERSION=$(yq $CHART_PATH/Chart.yaml --expression .version)
          if [[ ${{ github.event_name }} == 'pull_request' || ${{ github.event_name }} == 'push' && ${{ github.ref_type }} == 'branch' ]]; then
            echo "VERSION=$(echo $CURRENT_VERSION-${{ github.sha }})" >> $GITHUB_ENV
            echo "APP_VERSION=${{ github.sha }}" >> $GITHUB_ENV
          elif [[ ${{ github.event_name }} == 'workflow_call' ]]; then
            echo "VERSION=$(echo ${{ inputs.version }} | sed 's/v//')" >> $GITHUB_ENV
            echo "APP_VERSION=${{ inputs.version }}" >> $GITHUB_ENV
          else
            echo "Unsupported event type"
            exit 1
          fi

      - name: Helm Package
        run: helm package ${{ env.CHART_PATH }} -u --version ${{ env.VERSION }} --app-version ${{ env.APP_VERSION }}

      - name: Helm Push
        id: push
        run: |
          helm push ./${{ env.CHART_NAME }}-${{ env.VERSION }}.tgz oci://ghcr.io/${{ github.repository_owner }}/charts 2>&1 | tee push.log
          echo "digest=$(grep -oP '(?<=Digest: ).*' push.log)" >> "$GITHUB_OUTPUT"

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Login to GHCR for Cosign
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Sign Helm chart
        run: cosign sign --yes ${{ env.CHART_REPO }}/${{ env.CHART_NAME }}@${{ steps.push.outputs.digest }}