365 lines
13 KiB
YAML
365 lines
13 KiB
YAML
name: 🚀 Publish Helm Chart (Enhanced)
|
||
|
||
on:
|
||
push:
|
||
branches:
|
||
- main
|
||
paths:
|
||
- 'Chart.yaml'
|
||
- 'values.yaml'
|
||
- 'templates/**'
|
||
- 'examples/**'
|
||
pull_request:
|
||
branches:
|
||
- main
|
||
paths:
|
||
- 'Chart.yaml'
|
||
- 'values.yaml'
|
||
- 'templates/**'
|
||
- 'examples/**'
|
||
workflow_dispatch:
|
||
inputs:
|
||
version_bump:
|
||
description: 'Version bump type'
|
||
required: true
|
||
default: 'patch'
|
||
type: choice
|
||
options:
|
||
- patch
|
||
- minor
|
||
- major
|
||
force_publish:
|
||
description: 'Force publish even if version unchanged'
|
||
required: false
|
||
default: false
|
||
type: boolean
|
||
|
||
env:
|
||
CHART_PATH: .
|
||
REPO_URL: https://sakkiii.github.io/apache-nifi-helm
|
||
REGISTRY: ghcr.io
|
||
CHART_NAME: apache-nifi-helm
|
||
|
||
jobs:
|
||
# ==========================================
|
||
# VALIDATION & TESTING JOB
|
||
# ==========================================
|
||
# This job runs on both PRs and main branch pushes
|
||
# - On PRs: Only validates and tests (no publishing)
|
||
# - On main: Validates and provides outputs for publishing
|
||
validate:
|
||
name: 🔍 Validate & Test Chart
|
||
runs-on: ubuntu-22.04
|
||
outputs:
|
||
chart-version: ${{ steps.chart-info.outputs.version }}
|
||
app-version: ${{ steps.chart-info.outputs.app-version }}
|
||
version-changed: ${{ steps.version-check.outputs.changed }}
|
||
|
||
steps:
|
||
- name: 📥 Checkout Repository
|
||
uses: actions/checkout@v4
|
||
with:
|
||
fetch-depth: 0 # Full history for version comparison
|
||
|
||
- name: 🛠️ Set up Helm
|
||
uses: azure/setup-helm@v4.2.0
|
||
with:
|
||
version: '3.14.0' # Pin to specific version for reproducibility
|
||
|
||
- name: 📊 Extract Chart Information
|
||
id: chart-info
|
||
run: |
|
||
VERSION=$(yq eval '.version' Chart.yaml)
|
||
APP_VERSION=$(yq eval '.appVersion' Chart.yaml)
|
||
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
||
echo "app-version=$APP_VERSION" >> $GITHUB_OUTPUT
|
||
echo "📋 Chart Version: $VERSION"
|
||
echo "📋 App Version: $APP_VERSION"
|
||
|
||
- name: 🔄 Check Version Changes
|
||
id: version-check
|
||
run: |
|
||
CURRENT_VERSION="${{ steps.chart-info.outputs.version }}"
|
||
|
||
# Check if this version already exists in releases
|
||
if git tag --list | grep -q "^v$CURRENT_VERSION$"; then
|
||
echo "changed=false" >> $GITHUB_OUTPUT
|
||
echo "⚠️ Version $CURRENT_VERSION already exists"
|
||
else
|
||
echo "changed=true" >> $GITHUB_OUTPUT
|
||
echo "✅ New version $CURRENT_VERSION detected"
|
||
fi
|
||
|
||
- name: 🔍 Lint Helm Chart
|
||
run: |
|
||
echo "🔍 Linting Helm chart..."
|
||
helm lint "${{ env.CHART_PATH }}"
|
||
|
||
- name: 📦 Update Dependencies
|
||
run: |
|
||
echo "📦 Updating Helm dependencies..."
|
||
helm dependency update "${{ env.CHART_PATH }}"
|
||
|
||
- name: 🧪 Template Validation
|
||
run: |
|
||
echo "🧪 Validating Helm templates..."
|
||
|
||
# Test with different value files if examples directory exists
|
||
if [ -d "examples" ]; then
|
||
for values_file in examples/values-*.yaml; do
|
||
if [ -f "$values_file" ]; then
|
||
echo "Testing with $values_file"
|
||
helm template test-release . -f "$values_file" --debug > /dev/null
|
||
fi
|
||
done
|
||
else
|
||
echo "ℹ️ Examples directory not found, skipping example value file tests"
|
||
fi
|
||
|
||
# Test default values
|
||
helm template test-release . --debug > /dev/null
|
||
echo "✅ All template validations passed"
|
||
|
||
- name: 🔒 Security Scan with Checkov
|
||
uses: bridgecrewio/checkov-action@master
|
||
with:
|
||
directory: .
|
||
framework: kubernetes
|
||
output_format: sarif
|
||
output_file_path: checkov-results.sarif
|
||
continue-on-error: true
|
||
|
||
- name: 📤 Upload Security Results
|
||
if: always()
|
||
uses: github/codeql-action/upload-sarif@v3
|
||
with:
|
||
sarif_file: checkov-results.sarif
|
||
continue-on-error: true
|
||
|
||
- name: 🔍 Kubeconform Validation
|
||
run: |
|
||
echo "🔍 Installing kubeconform..."
|
||
curl -L https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz | tar xz
|
||
sudo mv kubeconform /usr/local/bin
|
||
|
||
echo "🧪 Validating Kubernetes manifests..."
|
||
# Use -skip to skip custom resources that don't have schemas
|
||
# This prevents failures on cert-manager resources like Certificate and Issuer
|
||
# Also use -ignore-missing-schemas to be more permissive
|
||
helm template test-release . | kubeconform -skip Certificate,Issuer -ignore-missing-schemas -summary
|
||
|
||
echo "✅ Kubeconform validation completed (custom resources skipped)"
|
||
|
||
# ==========================================
|
||
# PUBLISH JOB (Only on main branch)
|
||
# ==========================================
|
||
# This job only runs on main branch pushes when:
|
||
# - Version has changed (new chart version)
|
||
# - Force publish is requested via workflow_dispatch
|
||
# PRs will NOT trigger this job (only validation)
|
||
publish:
|
||
name: 📦 Package & Publish Chart
|
||
runs-on: ubuntu-22.04
|
||
needs: validate
|
||
if: |
|
||
github.ref == 'refs/heads/main' &&
|
||
(needs.validate.outputs.version-changed == 'true' ||
|
||
github.event.inputs.force_publish == 'true')
|
||
|
||
permissions:
|
||
contents: write
|
||
pages: write
|
||
packages: write
|
||
id-token: write
|
||
|
||
steps:
|
||
- name: 📥 Checkout Repository
|
||
uses: actions/checkout@v4
|
||
with:
|
||
token: ${{ secrets.GITHUB_TOKEN }}
|
||
|
||
- name: 🛠️ Set up Helm
|
||
uses: azure/setup-helm@v4.2.0
|
||
with:
|
||
version: '3.14.0'
|
||
|
||
- name: 🔑 Install Helm Plugins
|
||
run: |
|
||
helm plugin install https://github.com/chartmuseum/helm-push || true
|
||
helm plugin install https://github.com/helm/helm-2to3 || true
|
||
|
||
- name: 📦 Update Dependencies
|
||
run: |
|
||
helm dependency update "${{ env.CHART_PATH }}"
|
||
|
||
- name: 📦 Package Helm Chart
|
||
run: |
|
||
mkdir -p packaged-charts
|
||
helm package "${{ env.CHART_PATH }}" -d packaged-charts/
|
||
|
||
# List packaged files
|
||
ls -la packaged-charts/
|
||
|
||
- name: 🔐 Sign Chart (Optional)
|
||
if: env.GPG_PRIVATE_KEY != ''
|
||
env:
|
||
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
|
||
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
|
||
run: |
|
||
echo "$GPG_PRIVATE_KEY" | gpg --import --batch --yes
|
||
for chart in packaged-charts/*.tgz; do
|
||
helm package --sign --key "Helm Chart Signing" --keyring ~/.gnupg/secring.gpg "$chart"
|
||
done
|
||
|
||
- name: 🐳 Log in to GitHub Container Registry
|
||
uses: docker/login-action@v3
|
||
with:
|
||
registry: ${{ env.REGISTRY }}
|
||
username: ${{ github.actor }}
|
||
password: ${{ secrets.GITHUB_TOKEN }}
|
||
|
||
- name: 📦 Push to GitHub Packages (OCI)
|
||
run: |
|
||
VERSION="${{ needs.validate.outputs.chart-version }}"
|
||
CHART_FILE=$(find packaged-charts/ -name "*.tgz" | head -1)
|
||
|
||
echo "📦 Pushing chart to GitHub Packages as OCI artifact..."
|
||
echo "🔗 Registry: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.CHART_NAME }}"
|
||
echo "🏷️ Version: $VERSION"
|
||
|
||
# Push chart as OCI artifact
|
||
helm push "$CHART_FILE" oci://${{ env.REGISTRY }}/${{ github.repository_owner }}
|
||
|
||
echo "✅ Successfully pushed to GitHub Packages!"
|
||
echo "📋 Install command:"
|
||
echo "helm install my-nifi oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.CHART_NAME }} --version $VERSION"
|
||
|
||
- name: 📋 Generate Helm Index
|
||
run: |
|
||
helm repo index packaged-charts/ --url "${{ env.REPO_URL }}"
|
||
|
||
# Add metadata to index.yaml
|
||
cat >> packaged-charts/index.yaml << EOF
|
||
# Generated on: $(date -u +"%Y-%m-%dT%H:%M:%SZ")
|
||
# Chart Version: ${{ needs.validate.outputs.chart-version }}
|
||
# App Version: ${{ needs.validate.outputs.app-version }}
|
||
# Commit: ${{ github.sha }}
|
||
# OCI Registry: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ env.CHART_NAME }}
|
||
EOF
|
||
|
||
- name: 🏷️ Create Git Tag
|
||
run: |
|
||
VERSION="${{ needs.validate.outputs.chart-version }}"
|
||
git config user.name "github-actions[bot]"
|
||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||
|
||
git tag -a "v$VERSION" -m "Release version $VERSION"
|
||
git push origin "v$VERSION"
|
||
|
||
- name: 📝 Generate Release Notes
|
||
id: release-notes
|
||
run: |
|
||
VERSION="${{ needs.validate.outputs.chart-version }}"
|
||
APP_VERSION="${{ needs.validate.outputs.app-version }}"
|
||
|
||
cat > release-notes.md << EOF
|
||
# Apache NiFi Helm Chart v$VERSION
|
||
|
||
## 📋 Chart Information
|
||
- **Chart Version**: $VERSION
|
||
- **App Version**: $APP_VERSION (Apache NiFi)
|
||
- **Release Date**: $(date -u +"%Y-%m-%d")
|
||
|
||
## 🚀 Installation Options
|
||
|
||
### Option 1: GitHub Pages (Traditional Helm Repository)
|
||
\`\`\`bash
|
||
helm repo add apache-nifi-helm https://sakkiii.github.io/apache-nifi-helm
|
||
helm repo update
|
||
helm install my-nifi apache-nifi-helm/nifi --version $VERSION
|
||
\`\`\`
|
||
|
||
### Option 2: GitHub Packages (OCI Registry)
|
||
\`\`\`bash
|
||
helm install my-nifi oci://ghcr.io/sakkiii/apache-nifi-helm --version $VERSION
|
||
\`\`\`
|
||
|
||
## 🔐 Authentication Methods Supported
|
||
- ✅ **Basic Authentication** (Single User) - Default
|
||
- ✅ **OIDC Authentication** - Enterprise SSO
|
||
- ✅ **LDAP Authentication** - Directory Integration
|
||
|
||
## 📦 What's Included
|
||
- Multi-node clustering support
|
||
- Automatic TLS certificate management
|
||
- Persistent storage configuration
|
||
- Monitoring and metrics integration
|
||
- Production-ready security defaults
|
||
|
||
## 📚 Documentation
|
||
- [Chart README](https://github.com/sakkiii/apache-nifi-helm/blob/main/README.md)
|
||
- [Authentication Guide](https://github.com/sakkiii/apache-nifi-helm/blob/main/examples/)
|
||
- [Configuration Examples](https://github.com/sakkiii/apache-nifi-helm/tree/main/examples)
|
||
|
||
## 🔄 Upgrade Instructions
|
||
|
||
### From GitHub Pages Repository:
|
||
\`\`\`bash
|
||
helm upgrade my-nifi apache-nifi-helm/nifi --version $VERSION
|
||
\`\`\`
|
||
|
||
### From GitHub Packages (OCI):
|
||
\`\`\`bash
|
||
helm upgrade my-nifi oci://ghcr.io/sakkiii/apache-nifi-helm --version $VERSION
|
||
\`\`\`
|
||
|
||
---
|
||
**Full Changelog**: https://github.com/sakkiii/apache-nifi-helm/compare/v$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "0.0.0")...v$VERSION
|
||
EOF
|
||
|
||
- name: 🚀 Deploy to GitHub Pages
|
||
uses: peaceiris/actions-gh-pages@v4
|
||
with:
|
||
github_token: ${{ secrets.GITHUB_TOKEN }}
|
||
publish_dir: packaged-charts
|
||
publish_branch: gh-pages
|
||
user_name: "github-actions[bot]"
|
||
user_email: "github-actions[bot]@users.noreply.github.com"
|
||
commit_message: "📦 Publish chart version ${{ needs.validate.outputs.chart-version }}"
|
||
|
||
- name: 🎉 Create GitHub Release
|
||
uses: softprops/action-gh-release@v1
|
||
with:
|
||
tag_name: "v${{ needs.validate.outputs.chart-version }}"
|
||
name: "Apache NiFi Helm Chart v${{ needs.validate.outputs.chart-version }}"
|
||
body_path: release-notes.md
|
||
files: |
|
||
packaged-charts/*.tgz
|
||
packaged-charts/*.tgz.prov
|
||
draft: false
|
||
prerelease: false
|
||
|
||
# ==========================================
|
||
# NOTIFICATION JOB
|
||
# ==========================================
|
||
notify:
|
||
name: 📢 Notify Success
|
||
runs-on: ubuntu-22.04
|
||
needs: [validate, publish]
|
||
if: always() && needs.publish.result == 'success'
|
||
|
||
steps:
|
||
- name: 🎉 Success Notification
|
||
run: |
|
||
echo "🎉 Successfully published Apache NiFi Helm Chart!"
|
||
echo "📦 Version: ${{ needs.validate.outputs.chart-version }}"
|
||
echo ""
|
||
echo "📍 Available from multiple sources:"
|
||
echo "🔗 GitHub Pages: https://sakkiii.github.io/apache-nifi-helm"
|
||
echo "📦 GitHub Packages: ghcr.io/${{ github.repository_owner }}/${{ env.CHART_NAME }}"
|
||
echo "📋 Release: https://github.com/sakkiii/apache-nifi-helm/releases/tag/v${{ needs.validate.outputs.chart-version }}"
|
||
echo ""
|
||
echo "📋 Installation commands:"
|
||
echo "helm repo add apache-nifi-helm https://sakkiii.github.io/apache-nifi-helm && helm install my-nifi apache-nifi-helm/nifi"
|
||
echo "helm install my-nifi oci://ghcr.io/${{ github.repository_owner }}/${{ env.CHART_NAME }}"
|