Skip to content

Commit 59513bd

Browse files
janhoyjanhoy
committed
Dry-run flag in workflow
Validate url Validate checksum
1 parent e79b942 commit 59513bd

2 files changed

Lines changed: 146 additions & 22 deletions

File tree

‎.github/workflows/publish-helm-oci.yaml‎

Lines changed: 135 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,14 @@ on:
2828
description: 'URL to solr Helm chart tarball (e.g., https://dist.apache.org/repos/dist/release/solr/solr-operator/v0.10.0/helm-charts/solr-0.10.0.tgz)'
2929
required: true
3030
type: string
31+
dry-run:
32+
description: 'Dry run - download and verify charts but do not push to OCI registry'
33+
required: false
34+
type: boolean
35+
default: false
36+
37+
permissions:
38+
contents: read
3139

3240
jobs:
3341
publish-oci:
@@ -39,44 +47,152 @@ jobs:
3947
with:
4048
version: 'latest'
4149

50+
- name: Login to Docker Hub
51+
if: ${{ !inputs.dry-run }}
52+
uses: docker/login-action@v3
53+
with:
54+
username: ${{ secrets.DOCKERHUB_USER }}
55+
password: ${{ secrets.DOCKERHUB_TOKEN }}
56+
57+
- name: Validate Input URLs
58+
run: |
59+
# Validate URLs are from expected Apache dist domain
60+
if [[ ! "${{ inputs.solr-operator-chart-url }}" =~ ^https://dist\.apache\.org/repos/dist/(release|dev)/solr/ ]]; then
61+
echo "Error: solr-operator-chart-url must be from dist.apache.org"
62+
exit 1
63+
fi
64+
if [[ ! "${{ inputs.solr-chart-url }}" =~ ^https://dist\.apache\.org/repos/dist/(release|dev)/solr/ ]]; then
65+
echo "Error: solr-chart-url must be from dist.apache.org"
66+
exit 1
67+
fi
68+
echo "✓ URLs validated"
69+
4270
- name: Download Helm Charts
4371
run: |
72+
set -e
4473
echo "Downloading solr-operator chart from: ${{ inputs.solr-operator-chart-url }}"
45-
wget -O solr-operator.tgz "${{ inputs.solr-operator-chart-url }}"
74+
curl --fail --show-error --location --retry 3 --retry-delay 5 \
75+
-o solr-operator.tgz "${{ inputs.solr-operator-chart-url }}"
4676
4777
echo "Downloading solr chart from: ${{ inputs.solr-chart-url }}"
48-
wget -O solr.tgz "${{ inputs.solr-chart-url }}"
78+
curl --fail --show-error --location --retry 3 --retry-delay 5 \
79+
-o solr.tgz "${{ inputs.solr-chart-url }}"
4980
50-
echo "Charts downloaded successfully"
81+
echo "Charts downloaded successfully:"
5182
ls -lh *.tgz
5283
53-
- name: Login to Docker Hub
84+
# Verify they are valid tar files
85+
echo "Verifying chart integrity..."
86+
tar -tzf solr-operator.tgz > /dev/null
87+
tar -tzf solr.tgz > /dev/null
88+
echo "✓ Charts are valid tarballs"
89+
90+
- name: Download and Verify Checksums
5491
run: |
55-
echo "Logging in to Docker Hub as ${{ secrets.DOCKERHUB_USER }}"
56-
echo "${{ secrets.DOCKERHUB_TOKEN }}" | helm registry login docker.io -u "${{ secrets.DOCKERHUB_USER }}" --password-stdin
57-
echo "Login successful"
92+
set -e
93+
echo "Downloading checksums..."
94+
95+
# Download SHA512 checksums
96+
curl --fail --show-error --location --retry 3 --retry-delay 5 \
97+
-o solr-operator.tgz.sha512 "${{ inputs.solr-operator-chart-url }}.sha512"
98+
99+
curl --fail --show-error --location --retry 3 --retry-delay 5 \
100+
-o solr.tgz.sha512 "${{ inputs.solr-chart-url }}.sha512"
101+
102+
echo "Checksums downloaded:"
103+
ls -lh *.sha512
104+
105+
# Verify SHA512 checksums
106+
echo "Verifying solr-operator chart checksum..."
107+
sha512sum -c solr-operator.tgz.sha512
108+
echo "✓ solr-operator chart checksum verified"
109+
110+
echo "Verifying solr chart checksum..."
111+
sha512sum -c solr.tgz.sha512
112+
echo "✓ solr chart checksum verified"
113+
114+
echo ""
115+
echo "✅ All checksums verified successfully"
116+
117+
- name: Extract Chart Versions
118+
id: versions
119+
run: |
120+
# Extract version from solr-operator chart
121+
OPERATOR_VERSION=$(tar -xzOf solr-operator.tgz solr-operator/Chart.yaml | grep '^version:' | awk '{print $2}')
122+
echo "operator-version=${OPERATOR_VERSION}" >> $GITHUB_OUTPUT
123+
echo "Solr Operator Chart Version: ${OPERATOR_VERSION}"
124+
125+
# Extract version from solr chart
126+
SOLR_VERSION=$(tar -xzOf solr.tgz solr/Chart.yaml | grep '^version:' | awk '{print $2}')
127+
echo "solr-version=${SOLR_VERSION}" >> $GITHUB_OUTPUT
128+
echo "Solr Chart Version: ${SOLR_VERSION}"
58129
59130
- name: Push solr-operator chart to OCI registry
131+
if: ${{ !inputs.dry-run }}
60132
run: |
61-
echo "Pushing solr-operator chart to oci://docker.io/apache/solr-operator-chart"
133+
echo "Pushing solr-operator chart (version ${{ steps.versions.outputs.operator-version }}) to oci://docker.io/apache/solr-operator-chart"
62134
helm push solr-operator.tgz oci://docker.io/apache/solr-operator-chart
63-
echo "solr-operator chart pushed successfully"
135+
echo "✓ solr-operator chart pushed successfully"
64136
65137
- name: Push solr chart to OCI registry
138+
if: ${{ !inputs.dry-run }}
66139
run: |
67-
echo "Pushing solr chart to oci://docker.io/apache/solr-chart"
140+
echo "Pushing solr chart (version ${{ steps.versions.outputs.solr-version }}) to oci://docker.io/apache/solr-chart"
68141
helm push solr.tgz oci://docker.io/apache/solr-chart
69-
echo "solr chart pushed successfully"
142+
echo "✓ solr chart pushed successfully"
143+
144+
- name: Dry Run Summary
145+
if: ${{ inputs.dry-run }}
146+
run: |
147+
echo "## 🧪 Dry Run Mode - No Charts Published" >> $GITHUB_STEP_SUMMARY
148+
echo "" >> $GITHUB_STEP_SUMMARY
149+
echo "### Validation Results" >> $GITHUB_STEP_SUMMARY
150+
echo "- ✅ URLs validated from dist.apache.org" >> $GITHUB_STEP_SUMMARY
151+
echo "- ✅ Charts downloaded successfully" >> $GITHUB_STEP_SUMMARY
152+
echo "- ✅ Chart integrity verified (valid tarballs)" >> $GITHUB_STEP_SUMMARY
153+
echo "- ✅ SHA512 checksums verified" >> $GITHUB_STEP_SUMMARY
154+
echo "- ✅ Chart versions extracted" >> $GITHUB_STEP_SUMMARY
155+
echo "" >> $GITHUB_STEP_SUMMARY
156+
echo "### Chart Information" >> $GITHUB_STEP_SUMMARY
157+
echo "- **Solr Operator Version**: \`${{ steps.versions.outputs.operator-version }}\`" >> $GITHUB_STEP_SUMMARY
158+
echo "- **Solr Chart Version**: \`${{ steps.versions.outputs.solr-version }}\`" >> $GITHUB_STEP_SUMMARY
159+
echo "" >> $GITHUB_STEP_SUMMARY
160+
echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
161+
echo "Run this workflow again with **dry-run = false** to publish the charts to OCI registries." >> $GITHUB_STEP_SUMMARY
70162
71-
- name: Logout from Docker Hub
72-
if: always()
163+
- name: Verify Published Charts
164+
if: ${{ !inputs.dry-run }}
73165
run: |
74-
helm registry logout docker.io
75-
echo "Logged out from Docker Hub"
166+
echo "Verifying charts are accessible from OCI registry..."
167+
168+
# Verify solr-operator chart
169+
echo "Pulling solr-operator chart version ${{ steps.versions.outputs.operator-version }}..."
170+
helm pull oci://docker.io/apache/solr-operator-chart --version ${{ steps.versions.outputs.operator-version }}
171+
echo "✓ solr-operator chart verified"
172+
173+
# Verify solr chart
174+
echo "Pulling solr chart version ${{ steps.versions.outputs.solr-version }}..."
175+
helm pull oci://docker.io/apache/solr-chart --version ${{ steps.versions.outputs.solr-version }}
176+
echo "✓ solr chart verified"
76177
77178
- name: Summary
78-
if: success()
179+
if: ${{ success() && !inputs.dry-run }}
79180
run: |
80-
echo "✅ Successfully published Helm charts to OCI registries:"
81-
echo " - oci://docker.io/apache/solr-operator-chart"
82-
echo " - oci://docker.io/apache/solr-chart"
181+
echo "## ✅ Successfully Published Helm Charts" >> $GITHUB_STEP_SUMMARY
182+
echo "" >> $GITHUB_STEP_SUMMARY
183+
echo "The following charts have been published to OCI registries:" >> $GITHUB_STEP_SUMMARY
184+
echo "" >> $GITHUB_STEP_SUMMARY
185+
echo "### Solr Operator Chart" >> $GITHUB_STEP_SUMMARY
186+
echo "- **Registry**: \`oci://docker.io/apache/solr-operator-chart\`" >> $GITHUB_STEP_SUMMARY
187+
echo "- **Version**: \`${{ steps.versions.outputs.operator-version }}\`" >> $GITHUB_STEP_SUMMARY
188+
echo "- **Install**: \`helm install solr-operator oci://docker.io/apache/solr-operator-chart --version ${{ steps.versions.outputs.operator-version }}\`" >> $GITHUB_STEP_SUMMARY
189+
echo "" >> $GITHUB_STEP_SUMMARY
190+
echo "### Solr Chart" >> $GITHUB_STEP_SUMMARY
191+
echo "- **Registry**: \`oci://docker.io/apache/solr-chart\`" >> $GITHUB_STEP_SUMMARY
192+
echo "- **Version**: \`${{ steps.versions.outputs.solr-version }}\`" >> $GITHUB_STEP_SUMMARY
193+
echo "- **Install**: \`helm install solr oci://docker.io/apache/solr-chart --version ${{ steps.versions.outputs.solr-version }}\`" >> $GITHUB_STEP_SUMMARY
194+
echo "" >> $GITHUB_STEP_SUMMARY
195+
echo "### Verification" >> $GITHUB_STEP_SUMMARY
196+
echo "- ✅ Charts downloaded and checksums verified" >> $GITHUB_STEP_SUMMARY
197+
echo "- ✅ Charts pushed to OCI registries" >> $GITHUB_STEP_SUMMARY
198+
echo "- ✅ Charts verified as accessible from OCI registry" >> $GITHUB_STEP_SUMMARY

‎hack/release/wizard/releaseWizard.yaml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1145,16 +1145,24 @@ groups:
11451145
3. Fill in the workflow inputs:
11461146
- solr-operator-chart-url: {{ solr_operator_chart_url }}
11471147
- solr-chart-url: {{ solr_chart_url }}
1148+
- dry-run: false (set to true for validation without publishing)
11481149
1149-
4. Click "Run workflow" to start the publishing job
1150+
4. Optional: Run with dry-run=true first to verify:
1151+
- URLs are valid and accessible
1152+
- Charts download successfully
1153+
- SHA512 checksums match
1154+
- Chart versions are correct
11501155
1151-
5. Monitor the workflow execution for any errors
1156+
5. Click "Run workflow" to start the job
11521157
1153-
6. Verify successful completion by checking that both charts are accessible:
1158+
6. Monitor the workflow execution for any errors
1159+
1160+
7. Verify successful completion by checking that both charts are accessible:
11541161
helm pull oci://docker.io/apache/solr-operator-chart --version {{ release_version[1:] }}
11551162
helm pull oci://docker.io/apache/solr-chart --version {{ release_version[1:] }}
11561163
11571164
Note: The workflow uses repository secrets DOCKERHUB_USER and DOCKERHUB_TOKEN for authentication.
1165+
The workflow automatically verifies SHA512 checksums before publishing.
11581166
links:
11591167
- '{{ workflow_url }}'
11601168
- '{{ solr_operator_chart_url }}'

0 commit comments

Comments
 (0)