release-helm.yml

name: Release

on:
  workflow_call:
    inputs:
      CHARTS_DIR:
        description: Directory containing the Helm charts
        type: string
        required: false
        default: ./charts
      HELM_REPOS:
        description: Helm repositories to add (name=url, comma-separated)
        type: string
        required: false
      REGISTRY:
        description: OCI registry to push charts to (e.g. ghcr.io, registry.gitlab.com)
        type: string
        required: false
        default: ghcr.io
      REPOSITORY:
        description: Repository path in the OCI registry (defaults to github.repository)
        type: string
        required: false
      RUNS_ON:
        description: Runner labels as JSON array (e.g., '["ubuntu-24.04"]' or '["self-hosted", "linux"]')
        required: false
        type: string
        default: '["ubuntu-24.04"]'
    secrets:
      REGISTRY_USERNAME:
        description: Username for OCI registry authentication
        required: false
      REGISTRY_PASSWORD:
        description: Password for OCI registry authentication
        required: false

jobs:
  release:
    name: Create new release
    runs-on: ${{ fromJSON(inputs.RUNS_ON) }}
    permissions:
      contents: write
      packages: write
    steps:
    - name: Checks-out repository
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        fetch-depth: 0

    - name: Configure Git
      run: |
        git config user.name github-actions[bot]
        git config user.email github-actions[bot]@users.noreply.github.com

    - name: Install Helm
      uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0

    - name: Add Helm repos
      run: |
        for repo in $(echo "${{ inputs.HELM_REPOS }}" | tr ',' '\n'); do
          NAME="${repo%%=*}"
          URL="${repo#*=}"
          helm repo add "$NAME" "$URL"
        done
        helm repo update

    - name: Run chart-releaser
      id: chart-releaser
      uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
      with:
        version: v1.8.1
        charts_dir: ${{ inputs.CHARTS_DIR }}
        skip_upload: true
        packages_with_index: ""
        pages_branch: ""
      env:
        CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

    - name: Login to OCI Registry
      if: steps.chart-releaser.outputs.changed_charts != ''
      env:
        REGISTRY: ${{ inputs.REGISTRY }}
        USERNAME: ${{ inputs.REGISTRY == 'ghcr.io' && github.actor || secrets.REGISTRY_USERNAME }}
        PASSWORD: ${{ inputs.REGISTRY == 'ghcr.io' && secrets.GITHUB_TOKEN || secrets.REGISTRY_PASSWORD }}
      run: |
        echo "$PASSWORD" | helm registry login "$REGISTRY" -u "$USERNAME" --password-stdin

    - name: Publish charts to OCI registry
      if: steps.chart-releaser.outputs.changed_charts != ''
      env:
        REGISTRY: ${{ inputs.REGISTRY }}
        OCI_REPOSITORY: ${{ inputs.REPOSITORY }}
      run: |
        # Determine OCI repository path
        OCI_REPO="$OCI_REPOSITORY"
        if [ -z "$OCI_REPO" ]; then
          OCI_REPO="$GITHUB_REPOSITORY"
        fi

        # Normalize OCI repository path: lowercase and replace _ with -
        OCI_REPO=$(echo "$OCI_REPO" | tr '[:upper:]' '[:lower:]' | sed 's/_/-/g')

        # Only process charts that were actually released
        for chart_package in .cr-release-packages/*.tgz; do
          if [ ! -f "$chart_package" ]; then
            echo "No charts to publish"
            continue
          fi

          chart_file=$(basename "$chart_package")

          # Push to OCI registry
          echo "Publishing ${chart_file} to OCI registry..."
          helm push "$chart_package" oci://$REGISTRY/${OCI_REPO}
        done