push.helm.release.yml

---
name: Release updated charts (helm)
on:  # yamllint disable-line rule:truthy
  push:
    branches: [main]
    paths:
      # NOTE: only a few changes should trigger this pipeline
      - charts/*/templates/**
      - charts/*/Chart.lock
      - charts/*/Chart.yaml
      - charts/*/README.md
      - charts/*/values.yaml

env:
  HELM_CONFIG_HOME: ${{ github.workspace }}/test/e2e/~helm

jobs:
  release:
    name: Release Helm charts
    permissions:
      contents: write
      pages: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0
      - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
        with:
          version: v3.10.0

      - name: Prepare GPG environment for Helm
        id: import-gpg
        run: |
          GNUPG_DIR="$(mktemp --directory --tmpdir=${{ runner.temp }})"
          
          # Import GPG passphrase
          echo '${{ secrets.HELM_SIGN_KEY_PASSPHRASE }}' > "${GNUPG_DIR}/passphrase"
          echo "passphrase-file=${GNUPG_DIR}/passphrase" >> "${GITHUB_OUTPUT}"
          
          # Import GPG signing key
          echo '${{ secrets.HELM_SIGN_KEY }}' | gpg --dearmor > "${GNUPG_DIR}/secring.gpg"
          echo "keyring=${GNUPG_DIR}/secring.gpg" >> "${GITHUB_OUTPUT}"
          
          # Export signing key name
          (
            echo -n "name="
            gpg --with-colons --import-options show-only --import "${GNUPG_DIR}/secring.gpg" \
            | grep uid \
            | cut -d':' -f10
          ) >> "${GITHUB_OUTPUT}"

      - name: Configure git user
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
      - uses: helm/chart-releaser-action@09492f4b9670bf76e60f140461e72714e3a3a26d
        env:
          CR_GENERATE_RELEASE_NOTES: 'false'
          CR_KEY: ${{ steps.import-gpg.outputs.name }}
          CR_KEYRING: ${{ steps.import-gpg.outputs.keyring }}
          CR_PAGES_BRANCH: gh-helm
          CR_PASSPHRASE_FILE: ${{ steps.import-gpg.outputs.passphrase-file }}
          CR_SIGN: 'true'
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
        with:
          skip_existing: true

  list-changed-charts:
    name: List all new/updated charts
    permissions:
      contents: read
    uses: ./.github/workflows/_.helm.list-changed.yaml

  vulnerability:
    name: Check for vulnerabilities (${{ matrix.chart }})
    needs: [list-changed-charts]
    permissions:
      contents: read
      security-events: write
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        chart: ${{ fromJson(needs.list-changed-charts.outputs.charts) }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          format: sarif
          hide-progress: false
          output: trivy-results.sarif
          scan-ref: ${{ matrix.chart }}
          scan-type: config
      - uses: github/codeql-action/upload-sarif@9a866ed4524fc3422c3af1e446dab8efa3503411 # codeql-bundle-20230418
        with:
          category: trivy-helm-syntax
          sarif_file: trivy-results.sarif

      # NOTE: fail the build only if vulnerabilities with severity HIGH or CRITICAL are found
      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          exit-code: '1'
          format: table
          hide-progress: false
          scan-ref: ${{ matrix.chart }}
          scan-type: config
          severity: HIGH,CRITICAL