README.md

Important

Dependabot now supports helm so that functionality should be used, rather than this Action.

Bump Helm Chart Dependencies

This is an GitHub Action that will check the chart dependencies of a Helm chart are up to date with their source. If a new version is available, the Action will open a Pull Request inserting the new chart dependency versions into the helm chart file.

Table of Contents:

• 🔍 Overview
• 🤔 Assumptions bump-helm-deps Makes
• 📥 Inputs
• 🔒 Permissions
• ♻️ Example Usage
• 🎁 Acknowledgements
• ✨ Contributing

---

🔍 Overview

This is an overview of the steps the Action executes.

• Read the helm chart file and find the versions of the dependencies
• Scrape the helm chart source indexes and find the most recent version release for each dependency
• If there is a newer chart version available, then:
  • Create a new branch in the repository
  • Add the new version(s) to the helm chart file
  • Commit the file to the branch
  • Open a Pull Request to the default branch
  • Assign labels and reviewers to the Pull Request if required

A moderator should check and merge the Pull Request as appropriate.

🤔 Assumptions bump-helm-deps Makes

Here is a list detailing the assumptions that the Action makes.

1. You have a GitHub Token with enough permissions to access the GitHub API and create branches, commits and Pull Requests
2. The configuration for your helm chart is available in a public GitHub repository, or you have a token with sufficient permissions to read/write to a private repository
3. The dependent chart indexes are available at public URLs

📥 Inputs

Variable	Description	Required?	Default Value
chart_path	The path to the file that stores the helm chart dependencies	✅	-
chart_urls	A string-serialised dictionary storing the location of the dependent and their versions. E.g. '{"binderhub": "https://raw.githubusercontent.com/jupyterhub/helm-chart/gh-pages/index.yaml"}'	✅	-
github_token	A GitHub token to make requests to the API with. Requires write permissions to: create new branches, make commits, and open Pull Requests.	❌	${{github.token}}
repository	The GitHub repository where the helm chart is stored	❌	${{github.repository}}
base_branch	The base branch to open the Pull Request against	❌	main
head_branch	The branch to commit to and open a Pull Request from	❌	bump-helm-deps/{{ chart name }}/WXYZ where chart name is derived from the chart_path, and WXYZ will be a randomly generated ascii string (to avoid clashes)
labels	A comma-separated list of labels to apply to the opened Pull Request. Labels must already exist in the repository.	❌	[]
reviewers	A comma-separated list of GitHub users (without the leading @) to request reviews from	❌	[]
team_reviewers	A comma-separated list of GitHub teams to request reviews from	❌	[]
dry_run	Perform a dry-run of the action. A Pull Request will not be opened, but a log message will indicate if any helm chart versions can be bumped.	❌	False

🔒 Permissions

This Action will need permission to read the contents of a file stored in your repository, create a new branch, commit to that branch, and open a Pull Request. The default permissive settings of GITHUB_TOKEN should provide the relevant permissions.

If instead your repository is using the default restricted settings of GITHUB_TOKEN, you could grant just enough permissions to the Action using a permissions config, such as the one below:

permissions:
  contents: write
  pull-requests: write

♻️ Example Usage

The simplest way to use the Action is documented below. This config features a workflow_dispatch trigger to allow manual running whenever the maintainers desire, and a cron job trigger scheduled to run at 10am every weekday.

name: Check and Bump Helm Chart Dependencies

on:
  workflow_dispath:
  schedule:
    - cron: "0 10 * * 1-5"

jobs:
  bump-helm-deps:
    runs-on: ubuntu-latest
    steps:
    - uses: sgibson91/bump-helm-deps-action@main
      with:
        chart_path: path/to/config
        chart_urls: '{"chart_1": "https://example.com/chart_1/index.yaml"}'

🎁 Acknowledgements

Thank you to Christopher Hench (@henchc) who wrote and documented henchbot which automatically opens Pull Requests to upgrade mybinder.org. Give his blog post a read!

✨ Contributing

Thank you for wanting to contribute to the project! 🎉 Please read our Code of Conduct 💜 and Contributing Guidelines 👾 to get you started.