release.yml

---
name: release

"on":
  workflow_dispatch:
  push:
    branches:
      - master

permissions:
  contents: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    if: github.repository == 'promhippie/charts'

    steps:
      - name: Checkout source
        id: source
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup helm
        id: helm
        uses: azure/setup-helm@v4

      - name: Configure Git
        id: git
        run: |
          git config user.name "GitHub Actions"
          git config user.email "github@webhippie.de"

      - name: Update readme
        id: docs
        uses: docker://jnorwood/helm-docs:v1.14.2
        with:
          entrypoint: helm-docs

      - name: Write secring
        id: secring
        run: |
          echo -n "${{ secrets.GNUPG_SECRING }}" \
            | base64 --decode \
            > secring.gpg

      - name: Write passphrase
        id: passphrase
        run: |
          echo -n "${{ secrets.GNUPG_PASSWORD }}" \
            > passphrase

      - name: Run releaser
        id: releaser
        uses: helm/chart-releaser-action@v1.6.0
        env:
          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CR_KEYRING: secring.gpg
          CR_PASSPHRASE_FILE: passphrase
        with:
          config: cr.yaml
          charts_dir: stable

      - name: Push charts
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login --username bothippie --password-stdin ghcr.io

          for pkg in .cr-release-packages/*.tgz; do
            if [ -z "${pkg:-}" ]; then
              break
            fi

            echo "Pushing $pkg..."
            helm push "$pkg" "oci://ghcr.io/$GITHUB_REPOSITORY_OWNER/charts"
          done

      - name: Remove secrets
        id: cleanup
        if: always()
        run: |
          rm -f secring.gpg passphrase

...