bifrost-gateway-controller/.github/workflows/chart-publish.yaml at e15d9efe32e1ca6b4cda645789fe85cb8b2ed8df · tv2/bifrost-gateway-controller · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
name: Chart Release

on:
  push:
    branches:
      - main
    paths:
      - 'charts/bifrost-gateway-controller/Chart.yaml'

env:
  CHART: bifrost-gateway-controller

jobs:
  release-helm:
    permissions:
      contents: read
      packages: write
      id-token: none
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Install Helm
        uses: azure/setup-helm@v3
        with:
          version: v3.11.3

      - name: login to ghcr.io using helm
        run: |
          echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io/${{ github.repository }}-helm --username ${{ github.repository_owner }} --password-stdin

      - name: save helm chart to local registry
        run: |
          helm package charts/$CHART

      - name: publish chart to ghcr.io
        id: chart-push
        run: |
          VERSION=$(cat charts/$CHART/Chart.yaml | awk -F "[, ]+" '/version/{print $NF}')
          helm push "$CHART-helm-$VERSION.tgz" oci://ghcr.io/${{github.repository_owner}} 2>&1 | tee helm-push-out.txt
          echo "chartVersion=$VERSION" >> $GITHUB_OUTPUT

      - name: Chart meta
        id: meta
        run: |
          DIGEST=$(cat helm-push-out.txt | awk -F "[, ]+" '/Digest/{print $NF}')
          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
          CHART=$(echo ghcr.io/${{ github.repository }}-helm | tr '[:upper:]' '[:lower:]')
          echo "chart=$CHART@$DIGEST" >> $GITHUB_OUTPUT

    outputs:
      chartVersion: ${{ steps.chart-push.outputs.chartVersion }}
      digest: ${{ steps.meta.outputs.digest }}
      chart: ${{ steps.meta.outputs.chart }}

  sign-helm:
    needs: release-helm
    runs-on: ubuntu-latest
    permissions:
      contents: none
      packages: write
      id-token: write

    steps:
    - name: Log in to the Container registry
      uses: docker/login-action@v2
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # tag=v3.0.5

    - name: Sign chart
      run: cosign sign --yes -a "chartVersion=${{ needs.release-helm.outputs.chartVersion }}" ${{ needs.release-helm.outputs.chart }}

  verify-helm:
    needs: [ release-helm, sign-helm ]
    runs-on: ubuntu-latest

    steps:
    - uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # tag=v3.0.5

    - name: Verify signature
      run: cosign verify --certificate-identity-regexp 'https://github.com/${{ github.repository }}/.github/workflows/chart-publish.yaml@refs/.*' --certificate-oidc-issuer https://token.actions.githubusercontent.com ${{ needs.release-helm.outputs.chart }}