metrics-server/.gitea/workflows/publish.yml

name: Validate and publish metrics-server chart

on:
  push:
  pull_request:

jobs:
  validate:
    runs-on: linux_amd64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Helm
        run: |
          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" https://get.helm.sh/helm-v4.2.2-linux-amd64.tar.gz
          tar -xzf "${RUNNER_TEMP}/helm.tar.gz" -C "${RUNNER_TEMP}" linux-amd64/helm
          mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
          chmod 0700 "${RUNNER_TEMP}/helm"
          echo "${RUNNER_TEMP}" >> "$GITHUB_PATH"
      - run: ./test.sh

  publish:
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    needs: validate
    runs-on: linux_amd64
    outputs:
      chart_version: ${{ steps.chart.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install Helm
        run: |
          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" https://get.helm.sh/helm-v4.2.2-linux-amd64.tar.gz
          tar -xzf "${RUNNER_TEMP}/helm.tar.gz" -C "${RUNNER_TEMP}" linux-amd64/helm
          mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
          chmod 0700 "${RUNNER_TEMP}/helm"
          echo "${RUNNER_TEMP}" >> "$GITHUB_PATH"
      - id: chart
        name: Derive chart version
        env:
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          git fetch --tags origin main
          test "$(git rev-parse origin/main)" = "$COMMIT_SHA"
          description=$(git describe --tags --long --match 'v[0-9]*' --dirty)
          case "$description" in *-dirty) echo 'Refusing dirty chart tree' >&2; exit 1 ;; esac
          version=${description#v}
          case "$version" in *-0-g*) version=${version%%-0-g*} ;; esac
          echo "version=${version}" >> "$GITHUB_OUTPUT"
      - name: Package and publish
        env:
          PACKAGE_USERNAME: ${{ secrets.PACKAGE_USERNAME }}
          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
          CHART_VERSION: ${{ steps.chart.outputs.version }}
        run: |
          set -euo pipefail
          test -n "$PACKAGE_USERNAME" && test -n "$PACKAGE_TOKEN"
          helm lint chart
          ./test.sh
          helm package chart --version "$CHART_VERSION" --destination "$RUNNER_TEMP"
          curl --fail --silent --show-error --user "${PACKAGE_USERNAME}:${PACKAGE_TOKEN}" \
            --request POST --upload-file "${RUNNER_TEMP}/metrics-server-${CHART_VERSION}.tgz" \
            https://code.brunner.ninja/api/packages/feedc0de/helm/api/charts

  promote:
    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
    needs: publish
    runs-on: linux_amd64
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Promote GitOps chart version
        env:
          GITOPS_TOKEN: ${{ secrets.GITOPS_TOKEN }}
          CHART_VERSION: ${{ needs.publish.outputs.chart_version }}
          COMMIT_SHA: ${{ gitea.sha }}
        run: |
          set -euo pipefail
          test -n "$GITOPS_TOKEN"
          git fetch origin main
          test "$(git rev-parse origin/main)" = "$COMMIT_SHA"
          auth=$(printf 'feedc0de:%s' "$GITOPS_TOKEN" | base64 | tr -d '\n')
          git -c "http.extraheader=AUTHORIZATION: basic ${auth}" clone --depth=1 \
            https://code.brunner.ninja/feedc0de/homelab-gitops.git "$RUNNER_TEMP/gitops"
          unset auth
          cd "$RUNNER_TEMP/gitops"
          gitops_auth=$(printf 'feedc0de:%s' "$GITOPS_TOKEN" | base64 | tr -d '\n')
          unset GITOPS_TOKEN
          git config user.name feedc0de
          git config user.email feedc0de@users.noreply.code.brunner.ninja
          sed -i -E "0,/targetRevision: [^ ]+/s//targetRevision: ${CHART_VERSION}/" bootstrap/metrics-server.yaml
          if git diff --quiet; then exit 0; fi
          git add bootstrap/metrics-server.yaml
          git commit -m "Deploy metrics-server chart ${CHART_VERSION}"
          for attempt in 1 2 3; do
            if git -c "http.extraheader=AUTHORIZATION: basic ${gitops_auth}" push origin HEAD:main; then exit 0; fi
            git -c "http.extraheader=AUTHORIZATION: basic ${gitops_auth}" fetch origin main
            git rebase origin/main
          done
          exit 1