Repository navigation
chore(main): release 1.6.0 #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Package Helm Chart | ||
|
Check failure on line 1 in .github/workflows/helm-chart-package.yaml
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| jfrog_url: | ||
| description: "URL of Artifactory server" | ||
| type: string | ||
| default: "https://nethermind.jfrog.io" | ||
| CHART_PATH: | ||
| description: "Chart path" | ||
| type: string | ||
| required: true | ||
| CHART_FILENAME: | ||
| description: "Name of chart.yaml file" | ||
| type: string | ||
| default: "Chart.yaml" | ||
| secrets: | ||
| ARTIFACTORY_API_TOKEN: | ||
| description: "A token used to communicate with Artifactory" | ||
| required: true | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| jobs: | ||
| publish: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v5 | ||
| - name: Set up Helm | ||
| uses: azure/setup-helm@v4.3.1 | ||
| - name: Update Helm Dependencies | ||
| run: | | ||
| cd ${{ inputs.CHART_PATH }} | ||
| helm dependency update | ||
| - name: Lint Helm Chart | ||
| run: | | ||
| cd ${{ inputs.CHART_PATH }} | ||
| helm lint . | ||
| - name: Run Helm Tests if present | ||
| run: | | ||
| cd ${{ inputs.CHART_PATH }} | ||
| if [ -d "tests" ] && [ "$(ls -A tests)" ]; then | ||
| echo "Tests found. Running Helm tests..." | ||
| helm test . | ||
| else | ||
| echo "No tests found. Skipping Helm tests." | ||
| fi | ||
| - name: Set Environment Variables from ${{ inputs.CHART_FILENAME}} | ||
| run: | | ||
| cd ${{ inputs.CHART_PATH }} | ||
| echo "CHART_NAME=$(grep '^name:' ${{ inputs.CHART_FILENAME}} | awk '{print $2}')" >> $GITHUB_ENV | ||
| echo "CHART_VERSION=$(grep '^version:' ${{ inputs.CHART_FILENAME}} | awk '{print $2}')" >> $GITHUB_ENV | ||
| - name: Set up JFrog CLI | ||
| uses: jfrog/setup-jfrog-cli@6359487fb3e3de9d8ce7c1c8bbe8ed298a55d061 # v4.5.9 | ||
| - name: Configure JFrog CLI | ||
| env: | ||
| ARTIFACTORY_API_TOKEN: ${{ secrets.ARTIFACTORY_API_TOKEN }} | ||
| JFROG_URL: ${{ inputs.jfrog_url }} | ||
| run: | | ||
| echo "${ARTIFACTORY_API_TOKEN}" | jf config add test \ | ||
| --url="${JFROG_URL}" \ | ||
| --interactive=false \ | ||
| --access-token-stdin | ||
| - name: Check Backward Compatibility | ||
| id: backward-compatibility | ||
| run: | | ||
| cd ${{ inputs.CHART_PATH }} | ||
| # Fetch the previous version of the chart from JFrog Artifactory | ||
| git fetch origin main --depth=1 | ||
| echo "PREVIOUS_VERSION=$(git show origin/main:./${{ inputs.CHART_FILENAME}}| grep '^version:' | awk '{print $2}')" >> $GITHUB_ENV | ||
| jf rt dl "helm-local/${{ env.CHART_NAME }}-$PREVIOUS_VERSION.tgz" --flat | ||
| if [[ -f "${{ env.CHART_NAME }}-$PREVIOUS_VERSION.tgz" ]]; then | ||
| echo "Previous version ($PREVIOUS_VERSION) found. Checking for backward compatibility..." | ||
| # Render templates for the new and previous versions | ||
| helm template . > new-version.yaml | ||
| helm template ${{ env.CHART_NAME }}-$PREVIOUS_VERSION.tgz > previous-version.yaml | ||
| echo "Differences in the both charts template " | ||
| diff -u previous-version.yaml new-version.yaml | awk ' | ||
| /^-/ { last_removed=$0; print last_removed; next } | ||
| /^\+/ { if (last_removed != "") { print $0; last_removed="" } next } | ||
| '| tee diff.txt | ||
| else | ||
| echo "No previous version found. Skipping backward compatibility check." | ||
| fi | ||
| - name: Install Helm-docs and create README file for Helm chart | ||
| run: | | ||
| curl -sSLo helm-docs.tar.gz https://github.com/norwoodj/helm-docs/releases/download/v1.14.2/helm-docs_1.14.2_Linux_x86_64.tar.gz | ||
| tar -xzf helm-docs.tar.gz | ||
| chmod +x helm-docs | ||
| mv helm-docs /usr/local/bin/ | ||
| cd ${{ inputs.CHART_PATH }} | ||
| helm-docs ${{ inputs.CHART_PATH }} | ||
| - name: Check if the chart version already exist | ||
| run: | | ||
| echo "Previous Chart Version: ${{ env.PREVIOUS_VERSION }}" | ||
| echo "Current Chart Version: ${{ env.CHART_VERSION }}" | ||
| if [[ "${{ env.PREVIOUS_VERSION }}" != "${{ env.CHART_VERSION}}" ]]; then | ||
| echo "Chart version has changed!" | ||
| else | ||
| echo "Chart version already exist please update the chart version" | ||
| exit 1 | ||
| fi | ||
| - name: Package Helm Chart | ||
| run: | | ||
| cd ${{ inputs.CHART_PATH }} | ||
| helm package . --app-version ${{ env.CHART_VERSION}} | ||
| ls -la | ||
| - name: Run Trivy vulnerability scanner in IaC mode | ||
| id: trivy | ||
| continue-on-error: true | ||
| uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 | ||
| with: | ||
| scan-type: "config" | ||
| scan-ref: "${{ inputs.CHART_PATH }}${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}.tgz" | ||
| format: "sarif" | ||
| exit-code: "1" | ||
| ignore-unfixed: true | ||
| severity: "CRITICAL,HIGH" | ||
| output: "trivy-results.sarif" | ||
| env: | ||
| TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db | ||
| TRIVY_DISABLE_VEX_NOTICE: true | ||
| - name: merge trivy scan and diff result in single file to show it on PR marocchino/sticky-pull-request-comment | ||
| id: merge_trivy_and_diff_output | ||
| run: | | ||
| # Write Trivy result and diff into the output file in one go | ||
| { | ||
| echo "### Trivy Scan Result" | ||
| echo "Trivy Scan Result for Security Vulnerabilities:" | ||
| echo "" | ||
| cat trivy-results.sarif | ||
| echo "" | ||
| echo "----------------------------------------" | ||
| echo "" | ||
| echo "### Diff on Comparing Chart with Previous Version" | ||
| echo "Diff between the new and old chart versions:" | ||
| if [ -f "${{ inputs.CHART_PATH }}diff.txt" ]; then | ||
| echo "### Diff on Comparing Chart with Previous Version" | ||
| echo "Diff between the new and old chart versions:" | ||
| echo "" | ||
| cat ${{ inputs.CHART_PATH }}diff.txt | ||
| else | ||
| echo "No diff file found." | ||
| fi | ||
| } > pr_comment.txt | ||
| - name: Send notification on PR | ||
| if: if env.VERSION_INCREMENTED == 'true' && github.event_name == 'pull_request' | ||
| uses: marocchino/sticky-pull-request-comment@v2 | ||
| with: | ||
| header: "Chart Compatibility Check" | ||
| recreate: true | ||
| hide_classify: "OUTDATED" | ||
| path: pr_comment.txt | ||
| - name: Publish Helm Chart to JFrog if not Already Exists in JFrog | ||
| run: | | ||
| cd ${{ inputs.CHART_PATH }} | ||
| if jf rt s "helm-local/${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}.tgz" | grep -q "${{ env.CHART_NAME }}-${{ env.CHART_VERSION }}.tgz"; then | ||
| echo "❌ Helm chart ${{ env.CHART_NAME }} version ${{ env.CHART_VERSION }} already exists in JFrog. Please update the version before pushing." | ||
| exit 1 | ||
| else | ||
| echo "✅ Helm chart version ${{ env.CHART_VERSION }} is not found in JFrog. Proceeding with upload..." | ||
| jf rt u "*.tgz" "helm-local/" | ||
| fi | ||
| - name: Summary | ||
| if: always() | ||
| shell: bash | ||
| run: | | ||
| if [[ "${{ job.status }}" == "success" ]]; then | ||
| echo "✅ Helm chart published successfully" | ||
| else | ||
| echo "❌ Helm chart publishing failed" | ||
| fi | ||
| echo "### Trivy Scan Output" | ||
| if [[ -s 'trivy-results.sarif' ]]; then | ||
| cat trivy-results.sarif | ||
| else | ||
| echo "trivy-results.sarif file not found" | ||
| fi | ||
