Add Helm plugin distribution - #9
Open
Miosp wants to merge 5 commits into
Open
Conversation
Ship helm-scribe as a Helm plugin (helm scribe). Adds plugin.yaml and an install-binary.sh hook that downloads the matching prebuilt binary per OS/arch from GitHub Releases. GoReleaser now embeds the plugin files into each archive so verified tarball installs work on Helm v4, and emits a checksums.txt that the install hook verifies. sign-plugin.sh creates Helm provenance (.prov) files per archive and GPG clear-signs them; the release workflow runs it and uploads the .prov files when the HELM_SCRIBE_SIGNING_ENABLED repo variable is set. A one-time scripts/setup-signing-key.sh generates the dedicated signing key, exports the public signing-key.asc, and prints the secret material to add to GitHub. Documented both install paths (git URL with --verify=false, and verified release tarball) in the README.
install-binary.sh now resolves the latest release tag itself via GitHub's releases/latest redirect, so it no longer reads plugin.yaml's version field. Both install and update pull the newest release, which removes the need to manually bump plugin.yaml per release. The Release workflow stamps plugin.yaml's version from the git tag before GoReleaser packs it, so archive installs show the correct version in 'helm plugin list'. plugin.yaml's committed version is now a placeholder. Also smooths scripts/setup-signing-key.sh: writes the private armor to a gitignored file for easy clipboard copy, and prints clear GitHub secret/variable instructions.
install-binary.sh and sign-plugin.sh were at the repo root only because that mirrors helm-schema's layout. helm itself only requires plugin.yaml at the root; hook scripts can live anywhere. This repo keeps all helpers under scripts/, so move them there for consistency and update plugin.yaml, the GoReleaser files list, and the release workflow. Also drop sign-plugin.sh from the published archives since it is a CI-time script users never run.
Helm execs plugin commands and hooks directly with no shell, so the previous manifest (a bare command with no .exe and a .sh install hook) could not install or run on Windows. Switch plugin.yaml to platformCommand/platformHooks with per-OS entries: linux/darwin keep the .sh hook and the extensionless binary, windows points the command at helm-scribe.exe and runs a new scripts/install-binary.ps1 install hook. install-binary.ps1 mirrors install-binary.sh: it resolves the latest release tag via GitHub's releases/latest redirect, downloads the matching windows zip, verifies it against checksums.txt when available, and extracts helm-scribe.exe into the plugin bin dir. It targets Windows PowerShell 5.1 (shipped with Windows) so it works without PowerShell 7. platformCommand/platformHooks require Helm 3.18+; the plugin therefore needs Helm 3.18 or 4 on all platforms. GoReleaser now packs install-binary.ps1 into every archive so verified tarball installs are self-contained on Windows.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Helm plugin distribution so users can helm plugin install and run helm scribe, with GPG-signed releases for clean Helm v4 verification and native Windows support.
What's new
plugin.yamlexposes the plugin as helm scribe, usingplatformCommand/platformHooksfor per-OS commands and install hooks..goreleaser.yml: embeds the plugin files (plugin.yaml, both hooks) into every archive so verified tarball installs are self-contained, and emitschecksums.txt.plugin.yaml's version from the tag, and (gated on a repo variable) imports the signing key, signs, and uploads .prov files.