helm_chart.yaml

name: Publish Helm Repository
on:
  workflow_dispatch:
  push:
    branches: [main]
    tags: ["*"]
  pull_request:

env:
  MIX_ENV: prod
  KUBECONFIG: /home/runner/.kube/config

permissions:
  contents: read
  packages: write

jobs:
  publish_chart:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: oras-project/setup-oras@v1
        with:
          version: 1.0.0
      - name: helm dependency update
        run: helm dependency update
      - name: helm lint --set livebook.auth.livebookPassword=test
        run: |
          helm lint .
      - name: helm login
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io -u $ --password-stdin
      - name: helm package
        if: ${{ github.event_name == 'push' }}
        run: |
          echo "${{ secrets.CHART_SIGN_PRIVATE_KEY }}" | gpg --dearmor --output keyring.gpg
          helm package --sign --key 'Michael Ruoss (Livebook Helm Package Signing)' --keyring keyring.gpg .
      - name: helm push
        if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
        run: |
          git_tag = $(git describe --tags --abbrev=0)
          chart_tag = $(yq '.version' Chart.yaml)
          if [[ "$git_tag" == "v${chart_tag}" ]]; then
            helm push livebook-*.tgz oci://ghcr.io/${{ github.repository_owner }}/charts
          else
            echo "Git Tag and Chart.yaml version mismatch!"
            exit 1
          fi
      - name: Upload artifacthub-repo.yml
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | oras login ghcr.io -u mruoss --password-stdin
          oras push \
            ghcr.io/${{ github.repository_owner }}/charts/livebook:artifacthub.io \
            --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
            artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml