132 lines
4.0 KiB
YAML
132 lines
4.0 KiB
YAML
name: Validate, publish and promote Helm chart
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
HELM_VERSION: v4.2.2
|
|
KUBECONFORM_VERSION: v0.7.0
|
|
GITOPS_REPOSITORY: feedc0de/homelab-gitops
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate chart
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source and tags
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install Helm
|
|
uses: azure/setup-helm@v4
|
|
with:
|
|
version: ${{ env.HELM_VERSION }}
|
|
|
|
- name: Install Ruby
|
|
uses: ruby/setup-ruby@v1
|
|
with:
|
|
ruby-version: "3.3"
|
|
|
|
- name: Lint, render and test relationships
|
|
run: ./test.sh
|
|
|
|
- name: Validate rendered Kubernetes resources
|
|
run: |
|
|
helm template anubis chart \
|
|
--namespace default \
|
|
--values examples/forward-auth-values.yaml \
|
|
| docker run --rm --interactive \
|
|
"ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION}" \
|
|
-strict -ignore-missing-schemas -summary
|
|
|
|
publish:
|
|
name: Publish and promote chart
|
|
if: gitea.ref == 'refs/heads/main'
|
|
needs: validate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source and tags
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install Helm
|
|
uses: azure/setup-helm@v4
|
|
with:
|
|
version: ${{ env.HELM_VERSION }}
|
|
|
|
- name: Select immutable chart version
|
|
run: |
|
|
set -euo pipefail
|
|
printf 'CHART_VERSION=%s\n' "$(./scripts/chart-version.sh)" >> "${GITHUB_ENV}"
|
|
|
|
- name: Package and publish chart
|
|
env:
|
|
PACKAGE_USERNAME: ${{ secrets.PACKAGE_USERNAME }}
|
|
PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "${PACKAGE_USERNAME}"
|
|
test -n "${PACKAGE_TOKEN}"
|
|
install -d .chart-packages
|
|
helm package chart \
|
|
--destination .chart-packages \
|
|
--version "${CHART_VERSION}"
|
|
chart_file=".chart-packages/anubis-${CHART_VERSION}.tgz"
|
|
test -f "${chart_file}"
|
|
curl --fail --silent --show-error \
|
|
--user "${PACKAGE_USERNAME}:${PACKAGE_TOKEN}" \
|
|
--request POST \
|
|
--upload-file "${chart_file}" \
|
|
https://code.brunner.ninja/api/packages/feedc0de/helm/api/charts
|
|
|
|
- name: Check that this is still current main
|
|
id: current-main
|
|
env:
|
|
COMMIT_SHA: ${{ gitea.sha }}
|
|
run: |
|
|
git fetch --no-tags origin main
|
|
if [ "$(git rev-parse FETCH_HEAD)" = "${COMMIT_SHA}" ]; then
|
|
echo "promote=true" >> "${GITEA_OUTPUT}"
|
|
else
|
|
echo "This build is no longer current main; skipping promotion"
|
|
echo "promote=false" >> "${GITEA_OUTPUT}"
|
|
fi
|
|
|
|
- name: Check out GitOps repository
|
|
if: steps.current-main.outputs.promote == 'true'
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: ${{ env.GITOPS_REPOSITORY }}
|
|
ref: main
|
|
token: ${{ secrets.GITOPS_TOKEN }}
|
|
path: homelab-gitops
|
|
|
|
- name: Commit chart promotion
|
|
if: steps.current-main.outputs.promote == 'true'
|
|
working-directory: homelab-gitops
|
|
run: |
|
|
set -euo pipefail
|
|
./scripts/update-chart-version.sh anubis "${CHART_VERSION}"
|
|
git config user.name "feedc0de"
|
|
git config user.email "feedc0de@users.noreply.code.brunner.ninja"
|
|
git add bootstrap/anubis.yaml
|
|
if git diff --cached --quiet; then
|
|
echo "GitOps already selects ${CHART_VERSION}"
|
|
exit 0
|
|
fi
|
|
git commit -m "Deploy anubis chart ${CHART_VERSION}"
|
|
for attempt in 1 2 3; do
|
|
if git push origin HEAD:main; then
|
|
exit 0
|
|
fi
|
|
if [ "${attempt}" = 3 ]; then
|
|
echo "GitOps promotion failed after three attempts" >&2
|
|
exit 1
|
|
fi
|
|
git fetch origin main
|
|
git rebase origin/main
|
|
done
|