ci(chart): publish the dploy Helm chart as a signed OCI artifact #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Chart | |
| on: | |
| push: | |
| branches: ['**'] # every branch: lint + template + package as a smoke test | |
| tags: ['v*'] # tags: publish the signed OCI chart | |
| pull_request: | |
| branches: [main, master] | |
| env: | |
| REGISTRY: ghcr.io | |
| # Charts go under a dedicated repo path so they don't collide with the | |
| # container images already published at ghcr.io/<owner>/dploy(-operator). | |
| CHART_NAMESPACE: charts | |
| # Run JS-based actions on Node 24 now (silences the Node 20 deprecation warning) | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| validate: | |
| name: Lint and Template | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| - name: Lint chart | |
| run: helm lint charts/dploy | |
| - name: Render templates | |
| run: helm template dploy charts/dploy > /dev/null | |
| - name: Package chart (smoke) | |
| run: helm package charts/dploy --destination "${RUNNER_TEMP}/chart" | |
| publish: | |
| name: Publish OCI Chart | |
| runs-on: ubuntu-latest | |
| needs: validate | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write # keyless cosign signing | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Resolve version and owner | |
| id: meta | |
| run: | | |
| # ghcr requires a lowercase repository path. | |
| echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT" | |
| echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT" | |
| - name: Log in to Container Registry | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" \ | |
| | helm registry login "${REGISTRY}" --username "${{ github.actor }}" --password-stdin | |
| - name: Package chart | |
| id: package | |
| env: | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| run: | | |
| helm package charts/dploy \ | |
| --version "${VERSION}" \ | |
| --app-version "${VERSION}" \ | |
| --destination "${RUNNER_TEMP}/chart" | |
| echo "file=${RUNNER_TEMP}/chart/dploy-${VERSION}.tgz" >> "$GITHUB_OUTPUT" | |
| - name: Push and sign chart | |
| env: | |
| OCI_REPO: oci://${{ env.REGISTRY }}/${{ steps.meta.outputs.owner }}/${{ env.CHART_NAMESPACE }} | |
| run: | | |
| # helm push prints "Digest: sha256:..." on success — capture it so we | |
| # sign the exact artifact by digest rather than a mutable tag. | |
| helm push "${{ steps.package.outputs.file }}" "${OCI_REPO}" 2>&1 | tee push.log | |
| DIGEST="$(grep -oE 'sha256:[0-9a-f]{64}' push.log | head -n1)" | |
| if [ -z "${DIGEST}" ]; then | |
| echo "::error::could not parse pushed chart digest from helm output" | |
| exit 1 | |
| fi | |
| CHART_REF="${{ env.REGISTRY }}/${{ steps.meta.outputs.owner }}/${{ env.CHART_NAMESPACE }}/dploy@${DIGEST}" | |
| echo "Signing ${CHART_REF}" | |
| cosign sign --yes "${CHART_REF}" |