Skip to content

Commit db0a0ed

Browse files
Frederic SpiersixxeL2097
Frederic Spiers
authored and
ixxeL2097
committed
feat(ci): using separate workflows for gitguardian
1 parent 6504caf commit db0a0ed

File tree

4 files changed

+270
-96
lines changed

4 files changed

+270
-96
lines changed

‎.github/workflows/pull-request-gitguardian.yaml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
name: "Pull Request GitGuardian"
2+
on:
3+
pull_request:
4+
types:
5+
- opened
6+
- reopened
7+
- synchronize
8+
branches:
9+
- main
10+
11+
jobs:
12+
lint-test:
13+
runs-on: ubuntu-latest
14+
outputs:
15+
changed: ${{ steps.list-changed.outputs.changed }}
16+
changedCharts: ${{ steps.list-changed.outputs.changedCharts }}
17+
steps:
18+
- name: Setup Helm
19+
uses: Azure/setup-helm@v4.3.1
20+
with:
21+
version: 'v3.19.2'
22+
23+
- name: Checkout pull request branch
24+
uses: actions/checkout@v5.0.0
25+
with:
26+
ref: ${{ github.head_ref }}
27+
repository: ${{github.event.pull_request.head.repo.full_name}}
28+
fetch-depth: 0
29+
30+
# Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and
31+
# yamllint (https://github.com/adrienverge/yamllint) which require Python
32+
- name: Set up Python
33+
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
34+
with:
35+
python-version: 3.13
36+
37+
- name: Set up chart-testing-action
38+
uses: helm/chart-testing-action@v2.8.0
39+
40+
- name: Get changed charts
41+
id: list-changed
42+
run: |
43+
changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
44+
if [[ -n "$changed" ]]; then
45+
echo "Changed charts:"
46+
echo "$changed"
47+
echo "changed=true" >> $GITHUB_OUTPUT
48+
echo 'changedCharts<<EOF' >> $GITHUB_OUTPUT
49+
echo $changed >> $GITHUB_OUTPUT
50+
echo 'EOF' >> $GITHUB_OUTPUT
51+
else
52+
echo "No chart changes detected"
53+
fi
54+
55+
- name: Installing plugin helm-unittest
56+
if: steps.list-changed.outputs.changed == 'true'
57+
run: helm plugin install https://github.com/helm-unittest/helm-unittest >/dev/null
58+
59+
- name: Run chart testing (lint & unittest)
60+
if: steps.list-changed.outputs.changed == 'true'
61+
run: ct lint --target-branch ${{ github.event.repository.default_branch }} --validate-maintainers=false --additional-commands "helm unittest {{ .Path }}"
62+
63+
publish-chart:
64+
name: Publish Helm Chart
65+
needs: [lint-test]
66+
runs-on: ubuntu-latest
67+
steps:
68+
- uses: azure/setup-helm@v4.3.1
69+
with:
70+
version: 'v3.19.2'
71+
72+
- name: Checkout pull request branch
73+
uses: actions/checkout@v5.0.0
74+
with:
75+
ref: ${{ github.head_ref }}
76+
repository: ${{github.event.pull_request.head.repo.full_name}}
77+
fetch-depth: 0
78+
79+
- name: Set up chart-testing-action
80+
uses: helm/chart-testing-action@v2.8.0
81+
82+
- name: Get changed charts
83+
id: list-changed
84+
run: |
85+
changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
86+
if [[ -n "$changed" ]]; then
87+
echo "Changed charts:"
88+
echo "$changed"
89+
90+
changed_list=$(echo "$changed" | tr '\n' ',' | sed 's/,$//')
91+
echo "changed=$changed_list" >> $GITHUB_OUTPUT
92+
else
93+
echo "No chart changes detected"
94+
fi
95+
96+
- name: Publish Helm chart to ttl
97+
id: upload
98+
if: ${{ steps.list-changed.outputs.changed }}
99+
run: |
100+
CHANGED_CHARTS="${{ steps.list-changed.outputs.changed }}"
101+
102+
RELEASED_CHARTS=""
103+
for chart_directory in ${CHANGED_CHARTS//,/ }; do
104+
CHART_NAME=${chart_directory#charts/}
105+
106+
cd $chart_directory
107+
108+
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
109+
CHART_VERSION="0.1.0-${{ github.run_number }}"
110+
APP_VERSION="unstable-${SHORT_SHA}"
111+
112+
helm dep update .
113+
helm lint --strict .
114+
helm package . --app-version=${APP_VERSION} --version=${CHART_VERSION}
115+
116+
# Push to GHCR
117+
echo "Pushing Helm chart $CHART_NAME-$CHART_VERSION.tgz to oci://ttl.sh/${{ github.event.repository.name }}"
118+
if helm push ./$CHART_NAME-$CHART_VERSION.tgz oci://ttl.sh/${{ github.event.repository.name }}; then
119+
echo "Successfully released $CHART_NAME-$CHART_VERSION to ttl.sh"
120+
else
121+
echo "Failed to push $CHART_NAME-$CHART_VERSION to ttl.sh"
122+
exit 1
123+
fi
124+
125+
cd ${{ github.workspace }}
126+
done
127+
echo "released_charts=$RELEASED_CHARTS" >> "$GITHUB_OUTPUT"

‎.github/workflows/pull-request.yaml‎

Lines changed: 4 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "Pull Request"
22
on:
3-
pull_request:
3+
pull_request_target:
44
types:
55
- opened
66
- reopened
@@ -17,8 +17,6 @@ jobs:
1717
steps:
1818
- name: Setup Helm
1919
uses: Azure/setup-helm@v4.3.1
20-
with:
21-
version: 'v3.19.2'
2220

2321
- name: Checkout pull request branch
2422
uses: actions/checkout@v5.0.0
@@ -32,10 +30,10 @@ jobs:
3230
- name: Set up Python
3331
uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
3432
with:
35-
python-version: 3.13
33+
python-version: 3.x
3634

3735
- name: Set up chart-testing-action
38-
uses: helm/chart-testing-action@v2.8.0
36+
uses: helm/chart-testing-action@v2.7.0
3937

4038
- name: Get changed charts
4139
id: list-changed
@@ -145,70 +143,4 @@ jobs:
145143
git push
146144
else
147145
echo "No changed CHANGELOGS, skip push"
148-
fi
149-
150-
publish-chart:
151-
name: Publish Helm Chart
152-
needs: [lint-test]
153-
runs-on: ubuntu-latest
154-
steps:
155-
- uses: azure/setup-helm@v4.3.1
156-
with:
157-
version: 'v3.19.2'
158-
159-
- name: Checkout pull request branch
160-
uses: actions/checkout@v5.0.0
161-
with:
162-
ref: ${{ github.head_ref }}
163-
repository: ${{github.event.pull_request.head.repo.full_name}}
164-
fetch-depth: 0
165-
166-
- name: Set up chart-testing-action
167-
uses: helm/chart-testing-action@v2.8.0
168-
169-
- name: Get changed charts
170-
id: list-changed
171-
run: |
172-
changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
173-
if [[ -n "$changed" ]]; then
174-
echo "Changed charts:"
175-
echo "$changed"
176-
177-
changed_list=$(echo "$changed" | tr '\n' ',' | sed 's/,$//')
178-
echo "changed=$changed_list" >> $GITHUB_OUTPUT
179-
else
180-
echo "No chart changes detected"
181-
fi
182-
183-
- name: Publish Helm chart to ttl
184-
id: upload
185-
if: ${{ steps.list-changed.outputs.changed }}
186-
run: |
187-
CHANGED_CHARTS="${{ steps.list-changed.outputs.changed }}"
188-
189-
RELEASED_CHARTS=""
190-
for chart_directory in ${CHANGED_CHARTS//,/ }; do
191-
CHART_NAME=${chart_directory#charts/}
192-
193-
cd $chart_directory
194-
195-
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
196-
CHART_VERSION="0.1.0-${{ github.run_number }}"
197-
APP_VERSION="unstable-${SHORT_SHA}"
198-
199-
helm dep update .
200-
helm lint --strict .
201-
helm package . --app-version=${APP_VERSION} --version=${CHART_VERSION}
202-
203-
# Push to GHCR
204-
echo "Pushing Helm chart $CHART_NAME-$CHART_VERSION.tgz to oci://ttl.sh/${{ github.event.repository.name }}"
205-
if helm push ./$CHART_NAME-$CHART_VERSION.tgz oci://ttl.sh/${{ github.event.repository.name }}; then
206-
echo "Successfully released $CHART_NAME-$CHART_VERSION to ttl.sh"
207-
else
208-
echo "Failed to push $CHART_NAME-$CHART_VERSION to ttl.sh"
209-
exit 1
210-
fi
211-
212-
cd ${{ github.workspace }}
213-
done
214-
echo "released_charts=$RELEASED_CHARTS" >> "$GITHUB_OUTPUT"
146+
fi

‎.github/workflows/release-gitguardian.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Release Charts GitGuardian
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: write
10+
packages: write
11+
attestations: write
12+
id-token: write
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
16+
cancel-in-progress: true
17+
18+
jobs:
19+
publish-chart:
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v5
24+
with:
25+
fetch-depth: 0
26+
27+
- name: Configure Git
28+
run: |
29+
git config user.name "$GITHUB_ACTOR"
30+
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
31+
32+
- name: Login to GHCR Helm registry
33+
shell: bash
34+
run: |
35+
echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login \
36+
ghcr.io \
37+
--username ${{ github.actor }} \
38+
--password-stdin
39+
40+
- name: Run chart-releaser
41+
id: chart-releaser
42+
uses: helm/chart-releaser-action@v1.7.0
43+
with:
44+
skip_existing: true
45+
env:
46+
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
47+
48+
- name: Upload charts to OCI GHCR
49+
id: upload
50+
if: ${{ steps.chart-releaser.outputs.changed_charts }}
51+
run: |
52+
CHANGED_CHARTS="${{ steps.chart-releaser.outputs.changed_charts }}"
53+
REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
54+
55+
RELEASED_CHARTS=""
56+
for chart_directory in ${CHANGED_CHARTS//,/ }; do
57+
CHART_NAME=${chart_directory#charts/}
58+
59+
cd $chart_directory
60+
61+
CHART_VERSION=$(yq eval '.version' "Chart.yaml")
62+
APP_VERSION=$(yq eval '.appVersion' "Chart.yaml")
63+
64+
# Push to GHCR
65+
echo "Pushing Helm chart $CHART_NAME-$CHART_VERSION.tgz to oci://ghcr.io/${REPO_LOWER}"
66+
if helm push ${{ github.workspace }}/.cr-release-packages/${CHART_NAME}-${CHART_VERSION}.tgz oci://ghcr.io/${REPO_LOWER}; then
67+
echo "Successfully released $CHART_NAME-$CHART_VERSION to GHCR"
68+
else
69+
echo "Failed to push $CHART_NAME-$CHART_VERSION to GHCR"
70+
exit 1
71+
fi
72+
73+
cd ${{ github.workspace }}
74+
done
75+
echo "released_charts=$RELEASED_CHARTS" >> "$GITHUB_OUTPUT"

0 commit comments

Comments
 (0)