flux-hr-sync.yaml

---
  name: Flux HelmRepository Sync

  on:
    workflow_dispatch:
      inputs:
        helmRepoNamespace:
          description: Helm Repository Namespace
          default: flux-system
          required: true
        helmRepoName:
          description: Helm Repository Name
          required: true
    pull_request:
      branches: ["main"]
      paths: ["kubernetes/**/helmrelease.yaml"]

  jobs:
    sync:
      name: Flux HelmRepository Sync
      runs-on: ["arc-runner-set-k8s-gitops"]
      steps:
        - name: Generate Token
          uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
          id: app-token
          with:
            app-id: "${{ secrets.BOT_APP_ID }}"
            private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

        - name: Setup Path
          run: echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH

        - name: Setup Workflow Tools
          run: brew update && brew install fluxcd/tap/flux yq

        - name: Checkout
          uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
          with:
            token: "${{ steps.app-token.outputs.token }}"

        - name: Write kubeconfig
          id: kubeconfig
          uses: timheuer/base64-to-file@784a1a4a994315802b7d8e2084e116e783d157be # v1.2.4
          with:
            encodedString: "${{ secrets.KUBECONFIG }}"
            fileName: kubeconfig

        - if: ${{ github.event.inputs.helmRepoNamespace == '' && github.event.inputs.helmRepoName == '' }}
          name: Get changed files
          id: changed-files
          uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v45.0.4
          with:
            files: kubernetes/**/helmrelease.yaml
            safe_output: false

        - if: ${{ github.event.inputs.helmRepoNamespace == '' && github.event.inputs.helmRepoName == '' }}
          name: List All Changed Files
          run: echo "${{ steps.changed-files.outputs.all_changed_and_modified_files }}"

        - if: ${{ github.event.inputs.helmRepoNamespace == '' && github.event.inputs.helmRepoName == '' }}
          name: Sync HelmRepository
          env:
            KUBECONFIG: "${{ steps.kubeconfig.outputs.filePath }}"
          shell: bash
          run: |
            declare -a repos=()
            for f in ${{ steps.changed-files.outputs.all_changed_and_modified_files }}; do
                repo_namespace="$(yq -r '.spec.chart.spec.sourceRef.namespace' "${f}")"
                repo_name="$(yq -r '.spec.chart.spec.sourceRef.name' "${f}")"
                repos+=("${repo_namespace}:${repo_name}")
            done
            mapfile -t repos < <(printf "%s\n" "${repos[@]}" | sort -u)
            for r in "${repos[@]}"; do
                IFS=':' read -r repo_namespace repo_name <<< "${r}"
                flux \
                    --namespace ${repo_namespace} \
                    reconcile source helm ${repo_name}
            done

        - if: ${{ github.event.inputs.helmRepoNamespace != '' && github.event.inputs.helmRepoName != '' }}
          name: Sync HelmRepository
          env:
            KUBECONFIG: ${{ steps.kubeconfig.outputs.filePath }}
          shell: bash
          run: |
            flux \
                --namespace ${{ github.event.inputs.helmRepoNamespace }} \
                reconcile source helm ${{ github.event.inputs.helmRepoName }}