ci: lint, validate and publish the chart to GHCR

.github/workflows/chart.yml

@@ -0,0 +1,122 @@
+name: Chart
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  HELM_VERSION: v3.22.0
+  KUBECONFORM_VERSION: v0.8.0
+  KUBECONFORM_SHA256: 9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883
+  KUBE_VERSION: 1.34.0
+  CHART_REPOSITORY: oci://ghcr.io/${{ github.repository_owner }}/charts
+
+jobs:
+  validate:
+    name: Lint, render and package
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    outputs:
+      name: ${{ steps.chart.outputs.name }}
+      version: ${{ steps.chart.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Install kubeconform
+        run: |
+          curl -fsSLo kubeconform.tar.gz "https://github.com/yannh/kubeconform/releases/download/$KUBECONFORM_VERSION/kubeconform-linux-amd64.tar.gz"
+          echo "$KUBECONFORM_SHA256  kubeconform.tar.gz" | sha256sum -c -
+          mkdir -p "$RUNNER_TEMP/bin"
+          tar -xzf kubeconform.tar.gz -C "$RUNNER_TEMP/bin" kubeconform
+          rm kubeconform.tar.gz
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Read chart metadata
+        id: chart
+        run: |
+          name=$(helm show chart . | sed -n 's/^name: //p')
+          version=$(helm show chart . | sed -n 's/^version: //p')
+          [ -n "$name" ] && [ -n "$version" ] || { echo "::error::cannot read name/version from Chart.yaml"; exit 1; }
+          echo "name=$name" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Lint
+        run: helm lint --strict --kube-version "$KUBE_VERSION" .
+
+      - name: Render
+        run: helm template eoepca . --namespace eoepca --kube-version "$KUBE_VERSION" > "$RUNNER_TEMP/rendered.yaml"
+
+      # The Argo Workflows CRDs have no published schema; every other kind is validated.
+      - name: Validate rendered manifests
+        run: kubeconform -strict -summary -kubernetes-version "$KUBE_VERSION" -skip CustomResourceDefinition "$RUNNER_TEMP/rendered.yaml"
+
+      - name: Package
+        run: helm package . --destination dist
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: chart
+          path: dist/*.tgz
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    name: Publish
+    needs: validate
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: chart
+          path: dist
+
+      - name: Log in to GHCR
+        env:
+          ACTOR: ${{ github.actor }}
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: printf '%s' "$TOKEN" | helm registry login ghcr.io --username "$ACTOR" --password-stdin
+
+      # Chart versions are immutable: a version already in the registry is never overwritten.
+      - name: Push chart
+        env:
+          NAME: ${{ needs.validate.outputs.name }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          if helm show chart "$CHART_REPOSITORY/$NAME" --version "$VERSION" > /dev/null 2> lookup.err; then
+            echo "::warning::$NAME $VERSION already published, bump version in Chart.yaml to publish a new one"
+            exit 0
+          fi
+          if ! grep -q ': not found$' lookup.err; then
+            echo "::error::cannot check whether $NAME $VERSION is already published: $(cat lookup.err)"
+            exit 1
+          fi
+          helm push "dist/$NAME-$VERSION.tgz" "$CHART_REPOSITORY"
+
+      - name: Log out of GHCR
+        if: always()
+        run: helm registry logout ghcr.io || true

README.md

@@ -58,6 +58,14 @@ Create a values file with at least the overrides listed in
 helm install eoepca . --namespace eoepca --create-namespace -f my-values.yaml
 ```
 
+Released chart versions are also published to the GitHub Container Registry; to install one
+without a checkout:
+
+```bash
+helm install eoepca oci://ghcr.io/cgi-italy-insula-processing/charts/eoepca --version <version> \
+  --namespace eoepca --create-namespace -f my-values.yaml
+```
+
 The release namespace must not be named `<release>-workflows`: the chart creates that
 namespace for the workflow pods.