update-charts.yml

name: Update helm charts

on:
  workflow_dispatch:
    inputs:
      version:
        description: |
          version:
          Version of the release that triggered the workflow
        required: true
        type: string
        default: v1.10.0
      oldVersion:
        description: |
          oldVersion:
          Previous version of the release, already shipped in helm-charts
        required: true
        type: string
        default: v1.9.0
      repository:
        description: |
          repository:
          Repository of the release that triggered the workflow
        required: true
        # in case of developing, change to type string:
        # type: string
        type: choice
        options:
          - kubewarden/kubewarden-controller
          - kubewarden/policy-server
          - kubewarden/kwctl
          - kubewarden/audit-scanner

  repository_dispatch:
    types: [update-chart]

jobs:
  setvariables:
    name: Read variables from dispatch
    # read variables from either the repository_dispatch or the
    # workflow_dispatch, and create job outputs to reuse in other jobs.
    # It is not enough with env vars. We need job outputs, as they are shared
    # between jobs, since each job runs in a different VM instance.
    runs-on: ubuntu-latest
    outputs:
      version: ${{ github.event_name == 'repository_dispatch' && steps.from_repository_dispatch.outputs.version || steps.from_workflow_dispatch.outputs.version }}
      old_version: ${{ github.event_name == 'repository_dispatch' && steps.from_repository_dispatch.outputs.old_version || steps.from_workflow_dispatch.outputs.old_version }}
      repository: ${{ github.event_name == 'repository_dispatch' && steps.from_repository_dispatch.outputs.repository || steps.from_workflow_dispatch.outputs.repository }}
    steps:
      - name: Validate payload
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        if: github.event_name == 'repository_dispatch'
        with:
          script: |
            let repository = context.payload.client_payload.repository
            if (!repository.endsWith("kubewarden-controller") && !repository.endsWith("policy-server") && !repository.endsWith("kwctl") && !repository.endsWith("audit-scanner")) {
                    core.setFailed("Invalid repository")
            }

      - name: Set job output vars from repository_dispatch payload
        id: from_repository_dispatch
        if: github.event_name == 'repository_dispatch'
        run: |
          echo "old_version=${{ github.event.client_payload.oldVersion }}" >> "$GITHUB_OUTPUT"
          echo "version=${{ github.event.client_payload.version }}" >> "$GITHUB_OUTPUT"
          echo "repository=${{ github.event.client_payload.repository }}" >> "$GITHUB_OUTPUT"

      - name: Set job output vars from workflow_dispatch input
        id: from_workflow_dispatch
        if: github.event_name == 'workflow_dispatch'
        run: |
          echo "old_version=${{ inputs.oldVersion }}" >> "$GITHUB_OUTPUT"
          echo "version=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          echo "repository=${{ inputs.repository }}" >> "$GITHUB_OUTPUT"

  check-update-type:
    name: Detect update type
    runs-on: ubuntu-latest
    needs: setvariables
    outputs:
      update_type: ${{ steps.check_update_type.outputs.update_type }}
      repository: ${{ steps.check_update_type.outputs.repository }}
      prerelease: ${{ steps.check_update_type.outputs.prerelease }}
    steps:
      - name: Install semver comparison tool
        run: |
          INSTALL_DIR="$HOME"/.semver
          mkdir -p "$INSTALL_DIR"
          wget -O "$INSTALL_DIR"/semver https://github.com/fsaintjacques/semver-tool/raw/3.4.0/src/semver
          chmod +x "$INSTALL_DIR"/semver
          echo "$INSTALL_DIR" >> "$GITHUB_PATH"

      - name: Check if it is a patch update
        id: check_update_type
        run: |
          OLDVERSION="${{ needs.setvariables.outputs.old_version }}"
          NEWVERSION="${{ needs.setvariables.outputs.version }}"
          REPOSITORY="${{ needs.setvariables.outputs.repository }}"

          VALID="$(semver validate $OLDVERSION)"
          if [[ $VALID == "invalid" ]]; then
                  exit 1
          fi

          VALID="$(semver validate $NEWVERSION)"
          if [[ $VALID == "invalid" ]]; then
                  exit 1
          fi
          UPDATE_TYPE="$(semver diff $OLDVERSION $NEWVERSION)"
          PRERELEASE_SUFFIX="-$(semver get prerelease $NEWVERSION)"
          if [[ $PRERELEASE_SUFFIX == "-" ]];then
                PRERELEASE_SUFFIX=" "
          fi


          echo "update_type=$UPDATE_TYPE" >> "$GITHUB_OUTPUT"
          echo "repository=$REPOSITORY" >> "$GITHUB_OUTPUT"
          echo "prerelease=$PRERELEASE_SUFFIX" >> "$GITHUB_OUTPUT"

  patch-update:
    name: Patch release updates
    runs-on: ubuntu-latest
    needs:
      - check-update-type
      - setvariables
    if: needs.check-update-type.outputs.update_type == 'patch' && !endsWith(needs.check-update-type.outputs.repository, 'kwctl')
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: create env vars from needs.setvariables.outputs
        # This is neeeded because in scripts, we don't have a way to access the `needs` json object.
        # The env vars defined here will be accesible in the scripts under `process.env.foo`
        run: |
          echo "old_version=${{ needs.setvariables.outputs.old_version }}" >> "$GITHUB_ENV"
          echo "version=${{ needs.setvariables.outputs.version }}" >> "$GITHUB_ENV"
          echo "repository=${{ needs.setvariables.outputs.repository }}" >> "$GITHUB_ENV"

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Download CRDS controller
        if: endsWith(needs.setvariables.outputs.repository, 'kubewarden-controller')
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let repository_split = process.env.repository.split("/")
            let owner = repository_split[0]
            const repo = "kubewarden-controller"
            const version = process.env.version
            const crds_tarball = "CRDS.tar.gz"

            console.log(`Obtaining GH asset id for ${crds_tarball} in ${process.env.repository}`)
            let crds_asset_id = await github.rest.repos.getReleaseByTag({owner: owner, repo: repo, tag: version,}).then((response) => {
              for (const file of response.data.assets) {
                if (file.name == crds_tarball) {
                  return file.id;
                }
              }
              return null;
            }, (failedResponse) => {
              core.setFailed("Cannot obtain crds_assed_id, no matching CRDS.tar.gz found")
            });
            if (typeof(crds_asset_id) != "number") {
              core.setFailed(`No ${crds_tarball} found. This is expected if the ${repo} release job is still running. Otherwise, check why the release in the controller does not contains the CRDs tarball`)
            }

            console.log(`Fetching ${crds_tarball} asset with id: ${crds_asset_id}`)
            let asset = await github.rest.repos.getReleaseAsset({
                    owner: owner, repo: repo, asset_id: crds_asset_id, headers:{
                            accept: "application/octet-stream"},
            })
            let fs = require('fs');
            fs.writeFileSync("/tmp/crds-controller.tar.gz", Buffer.from(asset.data))
            console.log(`${crds_tarball} downloaded successfully`)

      - name: Download CRDS audit-scanner
        if: endsWith(needs.setvariables.outputs.repository, 'audit-scanner')
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let repository_split = process.env.repository.split("/")
            let owner = repository_split[0]
            const repo = "audit-scanner"
            const version = process.env.version
            const crds_tarball = "CRDS.tar.gz"

            console.log(`Obtaining GH asset id for ${crds_tarball} in ${process.env.repository}`)
            let crds_asset_id = await github.rest.repos.getReleaseByTag({owner: owner, repo: repo, tag: version,}).then((response) => {
              for (const file of response.data.assets) {
                if (file.name == crds_tarball) {
                  return file.id;
                }
              }
              return null;
            }, (failedResponse) => {
              core.setFailed("Cannot obtain crds_assed_id, no matching CRDS.tar.gz found")
            });
            if (typeof(crds_asset_id) != "number") {
              core.setFailed(`No ${crds_tarball} found. This is expected if the ${repo} release job is still running. Otherwise, check why the release in the controller does not contains the CRDs tarball`)
            }

            console.log(`Fetching ${crds_tarball} asset with id: ${crds_asset_id}`)
            let asset = await github.rest.repos.getReleaseAsset({
                    owner: owner, repo: repo, asset_id: crds_asset_id, headers:{
                            accept: "application/octet-stream"},
            })
            let fs = require('fs');
            fs.writeFileSync("/tmp/crds-audit-scanner.tar.gz", Buffer.from(asset.data))
            console.log(`${crds_tarball} downloaded successfully`)

      - name: Update CRDs
        if: endsWith(needs.setvariables.outputs.repository, 'kubewarden-controller') || endsWith(needs.setvariables.outputs.repository, 'audit-scanner')
        id: update_crds
        run: |
          # Install CRDs from tar.gz, and then see if there was any change,
          # which tells us if updatecli needs to bump the crds chart or not
          ./updatecli/scripts/install_crds.sh
          set +e
          git diff --exit-code --no-patch charts/kubewarden-crds
          echo "must_update_crds_chart=$?" >> "$GITHUB_OUTPUT"

      - name: Install Updatecli in the runner
        uses: updatecli/updatecli-action@79983ec58a76fe0c87fc76f5a5c7ef8df0bb36c4 # v2.77.0

      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
        id: generate-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Update kubewarden-defaults Helm chart
        if: endsWith(needs.setvariables.outputs.repository, 'policy-server')
        env:
          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
          UPDATECLI_CHART_VERSION: ${{ needs.setvariables.outputs.version }}
        run: "updatecli apply --config ./updatecli/updatecli.d/patch-kubewarden-defaults.yaml --values updatecli/values.yaml"

      - name: Update kubewarden-controller Helm chart with no CRDs update
        if: (endsWith(needs.setvariables.outputs.repository, 'kubewarden-controller') || endsWith(needs.setvariables.outputs.repository, 'audit-scanner')) && steps.update_crds.outputs.must_update_crds_chart==0
        env:
          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
          UPDATECLI_CHART_VERSION: ${{ needs.setvariables.outputs.version }}
        run: "updatecli apply --config ./updatecli/updatecli.d/patch-kubewarden-controller.yaml --values updatecli/values.yaml"

      - name: Update kubewarden-controller Helm chart with CRDs update
        if: (endsWith(needs.setvariables.outputs.repository, 'kubewarden-controller') || endsWith(needs.setvariables.outputs.repository, 'audit-scanner')) && steps.update_crds.outputs.must_update_crds_chart!=0
        env:
          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
          UPDATECLI_CHART_VERSION: ${{ needs.setvariables.outputs.version }}
        run: "updatecli apply --config ./updatecli/updatecli.d/patch-kubewarden-controller-with-crds-update.yaml --values updatecli/values.yaml"

  major-minor-prerelease-update:
    name: Major or minor release updates
    runs-on: ubuntu-latest
    needs:
      - check-update-type
      - setvariables
    if: needs.check-update-type.outputs.update_type == 'major' || needs.check-update-type.outputs.update_type == 'minor' || needs.check-update-type.outputs.update_type == 'prerelease'
    steps:
      - name: create env vars from needs.setvariables.outputs
        # This is neeeded because in scripts, we don't have a way to access the `needs` json object.
        # The env vars defined here will be accesible in the scripts under `process.env.foo`
        run: |
          echo "old_version=${{ needs.setvariables.outputs.old_version }}" >> "$GITHUB_ENV"
          echo "version=${{ needs.setvariables.outputs.version }}" >> "$GITHUB_ENV"
          echo "repository=${{ needs.setvariables.outputs.repository }}" >> "$GITHUB_ENV"

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Check if all components have a release with the same tag
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let repository_split = process.env.repository.split("/")
            let owner = repository_split[0]
            const version = process.env.version
            let repos = ['kubewarden-controller', 'policy-server', 'kwctl', 'audit-scanner']

            for (const repo of repos) {
              try {
                await github.rest.repos.getReleaseByTag({owner: owner, repo: repo, tag: version,})
              } catch (e) {
                  core.setFailed(`${repo} is missing a release for the tag ${version}`)
              }
            }

      - name: Download CRDs from Kubewarden controller
        id: download_crds_controller
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let repository_split = process.env.repository.split("/")
            let owner = repository_split[0]
            const repo = "kubewarden-controller"
            const version = process.env.version
            const crds_tarball = "CRDS.tar.gz"

            console.log(`Obtaining GH asset id for ${crds_tarball} in ${process.env.repository}`)
            let crds_asset_id = await github.rest.repos.getReleaseByTag({owner: owner, repo: repo, tag: version,}).then((response) => {
              for (const file of response.data.assets) {
                if (file.name == crds_tarball) {
                  return file.id;
                }
              }
              return null;
            }, (failedResponse) => {
              core.setFailed("Cannot obtain crds_assed_id, no matching CRDS.tar.gz found")
            });
            if (typeof(crds_asset_id) != "number") {
              core.setFailed(`No ${crds_tarball} found. This is expected if the ${repo} release job is still running. Otherwise, check why the release in the controller does not contains the CRDs tarball`)
            }

            console.log(`Fetching ${crds_tarball} asset with id: ${crds_asset_id}`)
            let asset = await github.rest.repos.getReleaseAsset({
                    owner: owner, repo: repo, asset_id: crds_asset_id, headers:{
                            accept: "application/octet-stream"},
            })
            let fs = require('fs');
            fs.writeFileSync("/tmp/crds-controller.tar.gz", Buffer.from(asset.data))
            console.log(`${crds_tarball} downloaded successfully`)

      - name: Download CRDs from audit scanner
        id: download_crds_audit_scanner
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            let repository_split = process.env.repository.split("/")
            let owner = repository_split[0]
            const repo = "audit-scanner"
            const version = process.env.version
            const crds_tarball = "CRDS.tar.gz"

            console.log(`Obtaining GH asset id for ${crds_tarball} in ${process.env.repository}`)
            let crds_asset_id = await github.rest.repos.getReleaseByTag({owner: owner, repo: repo, tag: version,}).then((response) => {
              for (const file of response.data.assets) {
                if (file.name == crds_tarball) {
                  return file.id;
                }
              }
              return null;
            }, (failedResponse) => {
              core.setFailed("Cannot obtain crds_assed_id, no matching CRDS.tar.gz found")
            });
            if (typeof(crds_asset_id) != "number") {
              core.setFailed(`No ${crds_tarball} found. This is expected if the ${repo} release job is still running. Otherwise, check why the release in the controller does not contains the CRDs tarball`)
            }

            console.log(`Fetching ${crds_tarball} asset with id: ${crds_asset_id}`)
            let asset = await github.rest.repos.getReleaseAsset({
                    owner: owner, repo: repo, asset_id: crds_asset_id, headers:{
                            accept: "application/octet-stream"},
            })
            let fs = require('fs');
            fs.writeFileSync("/tmp/crds-audit-scanner.tar.gz", Buffer.from(asset.data))
            console.log(`${crds_tarball} downloaded successfully`)

      - name: Update CRDS
        id: update_crds
        run: |
          # Install CRDs from tar.gz, and then see if there was any change,
          # which tells us if updatecli needs to bump the crds chart or not
          ./updatecli/scripts/install_crds.sh
          set +e
          git diff --exit-code --no-patch charts/kubewarden-crds
          echo "must_update_crds_chart=$?" >> "$GITHUB_OUTPUT"

      - name: Install Updatecli in the runner
        uses: updatecli/updatecli-action@79983ec58a76fe0c87fc76f5a5c7ef8df0bb36c4 # v2.77.0

      - uses: actions/create-github-app-token@0d564482f06ca65fa9e77e2510873638c82206f2 # v1.11.5
        id: generate-token
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Major or minor update Kubewarden charts with NO CRDs update
        if: steps.update_crds.outputs.must_update_crds_chart==0 &&  (needs.check-update-type.outputs.update_type == 'major' || needs.check-update-type.outputs.update_type == 'minor')
        env:
          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          UPDATECLI_SEMVERINC_UPDATE: ${{ needs.check-update-type.outputs.update_type }}
          UPDATECLI_PRERELEASE_SUFFIX: ${{ needs.check-update-type.outputs.prerelease }}
          UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
          UPDATECLI_CHART_VERSION: ${{ needs.setvariables.outputs.version }}
        run: "updatecli apply --config ./updatecli/updatecli.d/major-kubewarden-update.yaml --values updatecli/values.yaml"

      - name: Major or minor update Kubewarden charts WITH CRDs update
        if: steps.update_crds.outputs.must_update_crds_chart==1 &&  (needs.check-update-type.outputs.update_type == 'major' || needs.check-update-type.outputs.update_type == 'minor')
        env:
          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          UPDATECLI_SEMVERINC_UPDATE: ${{ needs.check-update-type.outputs.update_type }}
          UPDATECLI_PRERELEASE_SUFFIX: ${{ needs.check-update-type.outputs.prerelease }}
          UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
          UPDATECLI_CHART_VERSION: ${{ needs.setvariables.outputs.version }}
        run: "updatecli apply --config ./updatecli/updatecli.d/major-kubewarden-update-with-crd-update.yaml --values updatecli/values.yaml"

      - name: Prerelease update Kubewarden charts with NO CRDs update
        if: steps.update_crds.outputs.must_update_crds_chart==0 && needs.check-update-type.outputs.update_type == 'prerelease'
        env:
          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          UPDATECLI_SEMVERINC_UPDATE: ${{ needs.check-update-type.outputs.update_type }}
          UPDATECLI_PRERELEASE_SUFFIX: ${{ needs.check-update-type.outputs.prerelease }}
          UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
          UPDATECLI_CHART_VERSION: ${{ needs.setvariables.outputs.version }}
        run: "updatecli apply --config ./updatecli/updatecli.d/prerelease-kubewarden-update.yaml --values updatecli/values.yaml"

      - name: Prerelease update Kubewarden charts WITH CRDs update
        if: steps.update_crds.outputs.must_update_crds_chart==1 && needs.check-update-type.outputs.update_type == 'prerelease'
        env:
          UPDATECLI_GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
          UPDATECLI_SEMVERINC_UPDATE: ${{ needs.check-update-type.outputs.update_type }}
          UPDATECLI_PRERELEASE_SUFFIX: ${{ needs.check-update-type.outputs.prerelease }}
          UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
          UPDATECLI_CHART_VERSION: ${{ needs.setvariables.outputs.version }}
        run: "updatecli apply --config ./updatecli/updatecli.d/prerelease-kubewarden-update-with-crd-update.yaml --values updatecli/values.yaml"