release-and-test.yaml

name: Release Charts

on:
  pull_request:
    branches:
      - '*'
  push:
    branches:
      - "*"
env:
  HELM_VERSION: v3.11.3

jobs:

  find-charts:
    name: Find Charts
    runs-on: ubuntu-latest
    outputs:
      matrix: "${{ steps.get_changed_charts_folders.outputs.matrix }}"
    steps:
      - uses: actions/checkout@v1
      - name: Get changed charts
        id: get_changed_charts
        uses: tj-actions/changed-files@v35.9.1
        with:
          json: true
          path: "./charts/"
          diff_relative: true
          dir_names_max_depth: 1
          dir_names: true
          dir_names_exclude_root: true
          write_output_files: true
      - name: Echo changed files
        id: get_changed_charts_folders
        env:
          ALL_CHARTS: false
        run: |
          if $ALL_CHARTS
          then
            echo "Release all charts"
            cd charts && echo matrix="[$(ls -d -Q -m -w 0 *)]" >> $GITHUB_OUTPUT
          else
            echo matrix=${{ steps.get_changed_charts.outputs.all_changed_files }} >> $GITHUB_OUTPUT
          fi

  check-charts:
    name: Check
    needs: find-charts
    if: ${{ needs.find-charts.outputs.matrix != '' && toJson(fromJson(needs.find-charts.outputs.matrix)) != '[]' }}
    strategy:
      matrix:
        chart: ${{fromJSON(needs.find-charts.outputs.matrix)}}
    permissions:
      contents: write
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Setup Helm
        uses: azure/setup-helm@v3
        with:
          version: ${{ env.HELM_VERSION }}

#      - name: Trivy Scan ${{ matrix.chart }}
#        uses: aquasecurity/trivy-action@0.10.0
#        with:
#          scan-type: 'config'
#          hide-progress: false
#          format: 'sarif'
#          scan-ref: 'charts/${{matrix.chart}}'
#          output: 'trivy-results.sarif'
#          exit-code: '1'
#          ignore-unfixed: false
#          severity: 'MEDIUM,HIGH,CRITICAL'
#          trivyignores: 'charts/${{matrix.chart}}/.trivyignore'
#          limit-severities-for-sarif: false

      - name: Lint ${{ matrix.chart }}
        run: |
          helm dependency update charts/${{ matrix.chart }}
          helm lint charts/${{ matrix.chart }} --strict

      - name: KubeVal ${{ matrix.chart }}
        run: |
          helm plugin install https://github.com/instrumenta/helm-kubeval
          helm -f kubeval-values.yaml kubeval --ignore-missing-schemas --api-versions networking.k8s.io/v1/IngressClass charts/${{ matrix.chart }}
#
#      - name: Upload Trivy scan results for ${{ matrix.chart }}
#        uses: github/codeql-action/upload-sarif@v2
#        if: always()
#        with:
#          sarif_file: 'trivy-results.sarif'

  release-charts:
    name: Release
    if: github.ref == 'refs/heads/main'
    needs: check-charts
    permissions:
      contents: write
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
      - name: Add helm repositories
        run: |
          for dir in $(ls -d charts/*/); do
            helm dependency list $dir 2> /dev/null | tail +2 | head -n -1 | awk '{ print "helm repo add " $1 " " $3 }' | while read cmd; do $cmd; done
          done
      - name: Publish ${{ matrix.chart }}
        uses: helm/chart-releaser-action@v1.5.0
        env:
          CR_SKIP_EXISTING: true
          charts_dir: publish-charts
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"