publish.yml

## Reference: https://github.com/helm/chart-releaser-action
name: Chart Publish
on:
  push:
    branches:
      - argo-cd
    paths:
      - "charts/**"

permissions:
  contents: read

jobs:
  publish:
    permissions:
      contents: write  # for helm/chart-releaser-action to push chart release and create a release
      packages: write  # to push OCI chart package to GitHub Registry
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0

      - name: Install Helm
        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
        with:
          version: v3.10.1 # Also update in lint-and-test.yaml

      - name: Add dependency chart repos
        run: |
          helm repo add dandydeveloper https://dandydeveloper.github.io/charts/

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Package chart
        run: |
          rm -rf .cr-release-packages
          mkdir .cr-release-packages
          helm package charts/argo-cd -u -d .cr-release-packages/

      # The GitHub repository secret `PGP_PRIVATE_KEY` contains the private key
      # in ASCII-armored format. To export a (new) key, run this command:
      # `gpg --armor --export-secret-key <my key>`
      - name: Prepare PGP key
        run: |
          IFS=""
          echo "$PGP_PRIVATE_KEY" | gpg --dearmor > $HOME/secring.gpg
          echo "$PGP_PASSPHRASE" > $HOME/passphrase.txt

          # Tell chart-releaser-action where to find the key and its passphrase
          echo "CR_KEYRING=$HOME/secring.gpg" >> "$GITHUB_ENV"
          echo "CR_PASSPHRASE_FILE=$HOME/passphrase.txt" >> "$GITHUB_ENV"
        env:
          PGP_PRIVATE_KEY: "${{ secrets.PGP_PRIVATE_KEY }}"
          PGP_PASSPHRASE: "${{ secrets.PGP_PASSPHRASE }}"

      - name: Run chart-releaser
<<<<<<< HEAD
        # todo: change later to v1.6.0 (also in agro-rollouts chart)
        # issue: https://github.com/helm/chart-releaser-action/issues/171
        uses: helm/chart-releaser-action@be16258da8010256c6e82849661221415f031968 # v1.5.0
=======
        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
>>>>>>> upstream/main
        with:
          config: "./.github/configs/cr.yaml"
          skip_packaging: true
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      - name: Login to GHCR
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push chart to GHCR
        run: |
          shopt -s nullglob
          for pkg in .cr-release-packages/*.tgz; do
            if [ -z "${pkg:-}" ]; then
              break
            fi
            helm push "${pkg}" oci://ghcr.io/${{ github.repository }}
          done