alloy/.github/workflows/helm-release.yml

name: Release Helm chart
on:
  push:
    branches: [main]
  workflow_dispatch: {}
env:
  CR_CONFIGFILE: "${{ github.workspace }}/source/operations/helm/cr.yaml"
  CT_CONFIGFILE: "${{ github.workspace }}/source/operations/helm/ct.yaml"
  CR_INDEX_PATH: "${{ github.workspace }}/.cr-index"
  CR_PACKAGE_PATH: "${{ github.workspace }}/.cr-release-packages"
  CR_TOOL_PATH: "${{ github.workspace }}/.cr-tool"

permissions:
  contents: read

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      changed: ${{ steps.list-changed.outputs.changed }}
      chartpath: ${{ steps.list-changed.outputs.chartpath }}
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
          path: source
          persist-credentials: false

      - name: Install chart-testing
        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0

      - name: List changed charts
        id: list-changed
        run: |
          cd source

          latest_tag=$( if ! git describe --tags --abbrev=0 --match='helm-chart/*' 2> /dev/null ; then git rev-list --max-parents=0 --first-parent HEAD; fi )

          echo "Running: ct list-changed --config ${CT_CONFIGFILE} --since ${latest_tag} --target-branch ${GH_REF_NAME}"
          changed=$(ct list-changed --config "${CT_CONFIGFILE}" --since "${latest_tag}" --target-branch "${GH_REF_NAME}")
          echo "${changed}"

          num_changed=$(wc -l <<< ${changed})
          if [[ "${num_changed}" -gt "1" ]] ; then
            echo "More than one chart changed, exiting"
            exit 1
          fi
          if [[ -n "${changed}" ]]; then
            name=$(yq ".name" < ${changed}/Chart.yaml)
            version=$(yq ".version" < ${changed}/Chart.yaml)

            if [ $(git tag -l "helm-chart/${version}") ]; then
              echo "Tag helm-chart/${tagname} already exists, skipping release"
              echo "changed=false" >> $GITHUB_OUTPUT
            else
              echo "Releasing ${changed}"
              echo "changed=true" >> $GITHUB_OUTPUT
              echo "chartpath=${changed}" >> $GITHUB_OUTPUT
            fi
          else
            echo "No charts have changed, skipping release"
            echo "changed=false" >> $GITHUB_OUTPUT
          fi
        env:
          GH_REF_NAME: ${{ github.ref_name }}

  release:
    needs: [setup]
    runs-on: ubuntu-latest
    if: needs.setup.outputs.changed == 'true'
    permissions:
      contents: write # Needed to push to origin
      id-token: write # Needed to generate app token
    steps:
      - id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@5d7e361bc7e0a183cde8afe9899fb7b596d2659b # get-vault-secrets-v1.2.0
        with:
          repo_secrets: |
            ALLOYBOT_APP_ID=alloybot:app_id
            ALLOYBOT_PRIVATE_KEY=alloybot:private_key
          export_env: false

      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
        id: app-token
        with:
          app-id: ${{ fromJSON(steps.get-secrets.outputs.secrets).ALLOYBOT_APP_ID }}
          private-key: ${{ fromJSON(steps.get-secrets.outputs.secrets).ALLOYBOT_PRIVATE_KEY }}
          owner: grafana
          repositories: alloy,helm-charts

      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
          path: source
          token: ${{ steps.app-token.outputs.token }}
          persist-credentials: true # Needed for `git push origin tag_name`

      - name: Configure Git
        run: |
          cd source
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Checkout helm-charts
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
          repository: grafana/helm-charts
          path: helm-charts
          token: ${{ steps.app-token.outputs.token }}
          persist-credentials: false

      - name: Configure Git for helm-charts
        run: |
          cd helm-charts
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Set up Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          # renovate: datasource=github-releases packageName=helm/helm
          version: v3.10.3

      - name: Parse Chart.yaml
        id: parse-chart
        run: |
          cd source
          changed="${CHART_PATH}"
          description=$(yq ".description" < ${changed}/Chart.yaml)
          name=$(yq ".name" < ${changed}/Chart.yaml)
          version=$(yq ".version" < ${changed}/Chart.yaml)
          echo "chartpath=${changed}" >> $GITHUB_OUTPUT
          echo "desc=${description}" >> $GITHUB_OUTPUT
          echo "tagname=helm-chart/${version}" >> $GITHUB_OUTPUT
          echo "packagename=${name}-${version}" >> $GITHUB_OUTPUT
        env:
          CHART_PATH: ${{ needs.setup.outputs.chartpath }}

      - name: Install CR tool
        run: |
          mkdir "${CR_TOOL_PATH}"
          mkdir "${CR_PACKAGE_PATH}"
          mkdir "${CR_INDEX_PATH}"
          curl -sSLo cr.tar.gz "https://github.com/helm/chart-releaser/releases/download/v1.5.0/chart-releaser_1.5.0_linux_amd64.tar.gz"
          tar -xzf cr.tar.gz -C "${CR_TOOL_PATH}"
          rm -f cr.tar.gz

      - name: Create Helm package
        run: |
          cd source
          "${CR_TOOL_PATH}/cr" package "${CHART_PATH}" --config "${CR_CONFIGFILE}" --package-path "${CR_PACKAGE_PATH}"
          echo "Result of chart package:"
          ls -l "${CR_PACKAGE_PATH}"
        env:
          CHART_PATH: ${{ steps.parse-chart.outputs.chartpath }}


      - name: Create tag and check if exists on origin
        run: |
          cd source
          echo "Making tag ${TAG_NAME}"
          git tag "${TAG_NAME}"
        env:
          TAG_NAME: ${{ steps.parse-chart.outputs.tagname }}


      # Note that this creates a release in grafana/helm-charts with a new tag.
      # The tag name in grafana/helm-charts is <package>-<version>, while the
      # tag name for grafana/alloy is helm-chart/<version>.
      - name: Make github release
        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
        with:
          name: ${{ steps.parse-chart.outputs.packagename }}
          repository: grafana/helm-charts
          tag_name: ${{ steps.parse-chart.outputs.packagename }}
          token: ${{ steps.app-token.outputs.token }}
          body: |
            ${{ steps.parse-chart.outputs.desc }}

            Source commit: https://github.com/${{ github.repository }}/commit/${{ github.sha }}

            Tag on source: https://github.com/${{ github.repository }}/releases/tag/${{ steps.parse-chart.outputs.tagname }}
          files: |
            ${{ env.CR_PACKAGE_PATH }}/${{ steps.parse-chart.outputs.packagename }}.tgz

      - name: Push release tag on origin
        run: |
          cd source
          echo "Pushing tag ${TAG_NAME}"
          git push origin "${TAG_NAME}"
        env:
          TAG_NAME: ${{ steps.parse-chart.outputs.tagname }}

      - name: Update helm-charts index.yaml
        run: |
          cd helm-charts
          "${CR_TOOL_PATH}/cr" index --config "${CR_CONFIGFILE}" --token "${TOKEN}" --index-path "${CR_INDEX_PATH}" --package-path "${CR_PACKAGE_PATH}" --push
        env:
          TOKEN: ${{ steps.app-token.outputs.token }}
          TAG_NAME: ${{ steps.parse-chart.outputs.tagname }}