Make sure GoReleaser provides fleet-helm charts checksums too (#4975) (#5022)

* Make sure GoReleaser signs fleet-helm charts too

Author: thardeck

.github/scripts/package-charts.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+TAG="${1:?TAG argument required}"
+VERSION="${2:?VERSION argument required}"
+
+rm -rf .charts
+mkdir .charts
+
+# Skip chart packaging for hotfix releases
+if [[ "${IS_HOTFIX:-false}" == "true" ]]; then
+    exit 0
+fi
+
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "${TMP_DIR}"' EXIT
+
+find charts -maxdepth 1 -mindepth 1 -type d -exec cp -R {} "${TMP_DIR}/" \;
+
+# Update image tags in all chart values files
+find "${TMP_DIR}" -maxdepth 2 -name "values.yaml" -exec sed -i.bak \
+  -e "s@repository: rancher/\(fleet[-a-z]*\).*@repository: rancher/\1@" \
+  -e "s@tag: dev@tag: ${TAG}@" \
+  {} \;
+find "${TMP_DIR}" -name "*.bak" -delete
+
+while IFS= read -r chart_dir; do
+  helm package \
+    --version="${VERSION}" \
+    --app-version="${VERSION}" \
+    -d .charts \
+    "${chart_dir}"
+done < <(find "${TMP_DIR}" -maxdepth 1 -mindepth 1 -type d | sort)

.github/workflows/release.yml

@@ -235,31 +235,6 @@ jobs:
             cosign attest --yes --predicate provenance-slsav1.json --type slsaprovenance1 "${URL}"
           done
 
-      - name: Upload charts to release
-        if: ${{ env.IS_HOTFIX == 'false' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          repo: "rancher"
-        run: |
-          version=$(jq -r '.version' <<< '${{ steps.goreleaser.outputs.metadata }}')
-          tag=$(jq -r '.tag' <<< '${{ steps.goreleaser.outputs.metadata }}')
-          echo "publishing helm chart for (repo: $repo, tag: $tag, version: $version)"
-
-          # Replace rancher/fleet and rancher/fleet-agent and rancher/gitjob image names
-          sed -i \
-            -e "s@repository: rancher/\(fleet.*\|gitjob\).*@repository: $repo/\\1@" \
-            -e "s/tag:.*/tag: $tag/" \
-            charts/fleet/values.yaml
-
-          sed -i \
-            -e "s@repository: rancher/\(fleet.*\|gitjob\).*@repository: $repo/\\1@" \
-            -e "s/tag: dev/tag: $tag/" \
-            charts/fleet-agent/values.yaml
-
-          find charts/ -maxdepth 1 -mindepth 1 -type d -exec helm package --version="$version" --app-version="$version" -d ./dist {} \;
-
-          find dist/ -name '*.tgz' -exec gh release upload "$tag" {} +
-
       - name: Add charts to branch
         if: ${{ env.IS_HOTFIX == 'false' }}
         env:
@@ -292,7 +267,7 @@ jobs:
           fi
 
           mkdir -p charts
-          find dist/ -name '*.tgz' -exec tar -xf {} -C charts/ \;
+          find .charts/ -name '*.tgz' -exec tar -xf {} -C charts/ \;
 
           git add charts/**/*
           git commit -m "Update charts to version $version"

.gitignore

@@ -2,6 +2,7 @@
 /.cache
 /bin
 /dist
+/.charts
 *.swp
 .idea
 *.DS_Store

.goreleaser.yaml

@@ -11,6 +11,12 @@ env:
 release:
   prerelease: auto
   disable: "{{ .Env.IS_HOTFIX }}"
+  extra_files:
+    - glob: .charts/*.tgz
+
+checksum:
+  extra_files:
+    - glob: .charts/*.tgz
 
 changelog:
   disable: false
@@ -19,6 +25,7 @@ changelog:
 before:
   hooks:
     - go mod download
+    - bash .github/scripts/package-charts.sh {{ .Tag }} {{ .Version }}
 
 archives:
   - id: fleet-controller