release.yml

name: Release Charts

on:
  push:
    branches:
      - main

# Serialise chart publishing. chart-releaser creates a git tag and a GitHub
# Release per new chart version; two runs overlapping on the same commit race,
# and the loser dies on `422 Validation Failed [tag_name already_exists]` — which
# has already happened (runs 31591099966 / 31591103039, same sha, 3s apart).
# cancel-in-progress stays false: a cancelled run can leave a chart packaged and
# tagged but not indexed, which is worse than a queued one.
concurrency:
  group: release-charts
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Set up Helm
        uses: azure/setup-helm@v5
        with:
          version: v3.14.0

      - name: Run chart-releaser
        id: cr
        uses: helm/chart-releaser-action@v1.7.0
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      # Label prerelease chart versions as prereleases on GitHub.
      #
      # Helm already hides a prerelease (1.7.0-rc.1) from `helm install` unless
      # --devel is passed, so it cannot reach anyone by the normal path. GitHub
      # has no such rule: chart-releaser creates an ordinary release and marks
      # it latest, so an rc would sit at the top of the releases page looking
      # shipped. chart-releaser v1.7.0 cannot express this itself - its only
      # related option is the run-wide --make-release-latest - so the labelling
      # happens here, after the fact.
      #
      # Driven off the packaged charts rather than off Chart.yaml: these are
      # exactly the charts chart-releaser just released, and `helm show chart`
      # normalises the version, so a quoted `version: "1.7.0-rc.1"` cannot
      # produce a value that silently fails to match its own tag.
      #
      # Marking a release as a prerelease makes GitHub keep the Latest badge on
      # the newest stable release instead, which is the behaviour we want and
      # is why no run-wide badge suppression is needed.
      - name: Label prerelease charts on GitHub
        if: steps.cr.outputs.changed_charts != ''
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          for pkg in .cr-release-packages/*.tgz; do
            [ -f "$pkg" ] || continue
            name="$(helm show chart "$pkg" | awk '/^name:/ {print $2; exit}')"
            ver="$(helm show chart "$pkg" | awk '/^version:/ {print $2; exit}')"
            case "$ver" in
              *-*) ;;                 # prerelease: 1.7.0-rc.1
              *)   continue ;;        # stable: leave it exactly as released
            esac
            echo "::notice::Marking ${name}-${ver} as a prerelease (staged, not shipped)"
            gh release edit "${name}-${ver}" --prerelease --latest=false
          done

      # Mirror the charts chart-releaser just packaged (.cr-release-packages/)
      # to the GHCR OCI registry, alongside the HTTP repo (gh-pages) and
      # Artifact Hub, so catalogs that consume charts over OCI can pull
      # oci://ghcr.io/skyhook-io/charts/<name>. Gated on chart-releaser's own
      # changed_charts output so it only runs when a chart was actually released.
      - name: Push charts to GHCR (OCI)
        if: steps.cr.outputs.changed_charts != ''
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "${GITHUB_TOKEN}" | helm registry login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin

          for pkg in .cr-release-packages/*.tgz; do
            name="$(helm show chart "$pkg" | awk '/^name:/ {print $2; exit}')"
            ver="$(helm show chart "$pkg" | awk '/^version:/ {print $2; exit}')"

            # Chart versions are immutable. If this name+version is already in the
            # registry, skip rather than overwrite the digest — pushing a new digest
            # for an existing version breaks anyone pinning by digest.
            if helm show chart "oci://ghcr.io/skyhook-io/charts/${name}" --version "${ver}" >/dev/null 2>&1; then
              echo "::notice::${name}-${ver} already in GHCR OCI, skipping"
              continue
            fi

            echo "Pushing ${name}-${ver} to oci://ghcr.io/skyhook-io/charts"
            helm push "${pkg}" oci://ghcr.io/skyhook-io/charts
          done