ci(helm): publish charts to GHCR instead of creating releases

2026-08-19 00:37:48 +02:00 · 2026-08-17 14:33:40 -04:00
parent 89ad51d4ce
commit 46cc602d37
12 changed files with 119 additions and 265 deletions
--- a/.github/workflows/helm-charts.yml
+++ b/.github/workflows/helm-charts.yml
@@ -0,0 +1,109 @@
+name: Helm charts
+
+on:
+  pull_request:
+    paths:
+      - "supplemental/helm/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "supplemental/helm/**"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  OCI_REGISTRY: ghcr.io/henrygd/beszel-charts
+
+jobs:
+  changes:
+    name: Detect changed charts
+    runs-on: ubuntu-latest
+    outputs:
+      charts: ${{ steps.changes.outputs.charts }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed charts
+        id: changes
+        env:
+          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          charts=()
+
+          for name in beszel-agent beszel-hub; do
+            path="supplemental/helm/$name"
+            if ! git diff --quiet "$BASE_SHA" "$GITHUB_SHA" -- "$path"; then
+              charts+=("$name|$path")
+            fi
+          done
+
+          printf '%s\n' "${charts[@]}" \
+            | jq -Rsc 'split("\n") | map(select(length > 0) | split("|") | {name: .[0], path: .[1]})' \
+            | xargs -0 printf 'charts=%s\n' >> "$GITHUB_OUTPUT"
+
+  validate-and-publish:
+    name: ${{ github.event_name == 'push' && 'Publish' || 'Validate' }} ${{ matrix.chart.name }}
+    needs: changes
+    if: needs.changes.outputs.charts != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        chart: ${{ fromJSON(needs.changes.outputs.charts) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Lint chart
+        run: helm lint "${{ matrix.chart.path }}" --set env.KEY=ci-placeholder
+
+      - name: Render chart
+        run: helm template "${{ matrix.chart.name }}" "${{ matrix.chart.path }}" --set env.KEY=ci-placeholder > /dev/null
+
+      - name: Package chart
+        id: package
+        env:
+          CHART_NAME: ${{ matrix.chart.name }}
+          CHART_PATH: ${{ matrix.chart.path }}
+        run: |
+          version=$(awk '/^version:/ { print $2 }' "$CHART_PATH/Chart.yaml")
+          test -n "$version"
+
+          mkdir -p .helm-packages
+          helm package "$CHART_PATH" --destination .helm-packages
+
+          package=".helm-packages/${CHART_NAME}-${version}.tgz"
+          test -f "$package"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "package=$package" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: echo "$GITHUB_TOKEN" | helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+
+      - name: Check chart version is unpublished
+        env:
+          CHART_NAME: ${{ matrix.chart.name }}
+          CHART_VERSION: ${{ steps.package.outputs.version }}
+        run: |
+          chart="oci://${OCI_REGISTRY}/${CHART_NAME}"
+          if helm show chart "$chart" --version "$CHART_VERSION" > /dev/null 2>&1; then
+            echo "${CHART_NAME} ${CHART_VERSION} is already published. Bump version in Chart.yaml." >&2
+            exit 1
+          fi
+
+      - name: Publish chart
+        if: github.event_name == 'push'
+        run: helm push "${{ steps.package.outputs.package }}" "oci://${OCI_REGISTRY}"