Skip to content

automated release for helm chart #335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Rupam-It wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

automated release for helm chart #335

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
116 changes: 116 additions & 0 deletions .github/workflows/helm-auto-release-netmon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,116 @@
name: Auto Release Helm Chart (zxporter-netmon)

# Triggers on any merge to main that touches helm-chart/zxporter-netmon/**
# EXCEPT Chart.yaml — that file is updated by this workflow itself via PR,
# and we exclude it to prevent an infinite release loop.
on:
push:
branches: [main]
paths:
- 'helm-chart/zxporter-netmon/**'
- '!helm-chart/zxporter-netmon/Chart.yaml'

env:
REGISTRY: registry-1.docker.io
CHART_NAME: zxporter-netmon
ORG: devzeroinc
CHART_TAG_PREFIX: chart-netmon-v

jobs:
auto-release:
name: Patch release zxporter-netmon chart
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
pull-requests: write

steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Set up Helm
uses: azure/setup-helm@v4
with:
version: '3.12.3'

- name: Install yq
run: |
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
sudo chmod +x /usr/local/bin/yq

- name: Helm registry login
run: |
echo "${{ secrets.DOCKERHUB_ZXPORTER_BALANCE_TOKEN }}" | \
helm registry login registry-1.docker.io \
--username "${{ secrets.DOCKERHUB_ZXPORTER_BALANCE_USERNAME }}" \
--password-stdin

- name: Enable Helm OCI support
run: echo "HELM_EXPERIMENTAL_OCI=1" >> $GITHUB_ENV

- name: Fetch tags
run: git fetch --tags

- name: Bump patch version
id: version
run: |
LAST_TAG=$(git tag --list '${{ env.CHART_TAG_PREFIX }}*' --sort=-v:refname | head -n 1)
if [ -z "$LAST_TAG" ]; then
LAST_VERSION="0.0.0"
else
LAST_VERSION="${LAST_TAG#${{ env.CHART_TAG_PREFIX }}}"
fi
IFS='.' read -r MAJOR MINOR PATCH <<< "$LAST_VERSION"
PATCH=$((PATCH + 1))
NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
echo "Auto-releasing chart patch: $LAST_VERSION → $NEW_VERSION (triggered by: ${{ github.event.head_commit.message }})"

- name: Create and push chart tag
run: |
git config --global user.email "actions@github.com"
git config --global user.name "GitHub Actions"
git tag "${{ env.CHART_TAG_PREFIX }}${{ steps.version.outputs.new_version }}"
git push origin "${{ env.CHART_TAG_PREFIX }}${{ steps.version.outputs.new_version }}"

- name: Update chart dependencies
run: helm dependency update helm-chart/zxporter-netmon

- name: Lint Helm chart
run: helm lint helm-chart/zxporter-netmon

- name: Package Helm chart
run: |
mkdir -p helm-chart/packages
helm package helm-chart/zxporter-netmon \
--version ${{ steps.version.outputs.new_version }} \
--app-version ${{ steps.version.outputs.new_version }} \
--destination helm-chart/packages

- name: Push chart to Docker Hub OCI registry
run: |
helm push helm-chart/packages/zxporter-netmon-${{ steps.version.outputs.new_version }}.tgz \
oci://${{ env.REGISTRY }}/${{ env.ORG }}

- name: Update Chart.yaml version and appVersion
run: |
yq e -i '.version = "${{ steps.version.outputs.new_version }}"' helm-chart/zxporter-netmon/Chart.yaml
yq e -i '.appVersion = "${{ steps.version.outputs.new_version }}"' helm-chart/zxporter-netmon/Chart.yaml

- name: Create PR to update Chart.yaml
uses: peter-evans/create-pull-request@v6
with:
commit-message: "chore(helm): update Chart.yaml version to ${{ steps.version.outputs.new_version }}"
title: "chore(helm): update zxporter-netmon Chart.yaml version to ${{ steps.version.outputs.new_version }}"
body: |
Automated patch release triggered by changes to `helm-chart/zxporter-netmon/`.

This PR updates `version` and `appVersion` in `helm-chart/zxporter-netmon/Chart.yaml` to `${{ steps.version.outputs.new_version }}`.

Triggered by commit: ${{ github.event.head_commit.message }}
branch: "update/chart-version-netmon-${{ steps.version.outputs.new_version }}"
add-paths: |
helm-chart/zxporter-netmon/Chart.yaml
116 changes: 116 additions & 0 deletions .github/workflows/helm-auto-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,116 @@
name: Auto Release Helm Chart (zxporter)

# Triggers on any merge to main that touches helm-chart/zxporter/**
# EXCEPT Chart.yaml — that file is updated by this workflow itself via PR,
# and we exclude it to prevent an infinite release loop.
on:
push:
branches: [main]
paths:
- 'helm-chart/zxporter/**'
- '!helm-chart/zxporter/Chart.yaml'

env:
REGISTRY: registry-1.docker.io
CHART_NAME: zxporter
ORG: devzeroinc
CHART_TAG_PREFIX: chart-v

jobs:
auto-release:
name: Patch release zxporter chart
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
pull-requests: write

steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Set up Helm
uses: azure/setup-helm@v4
with:
version: '3.12.3'

- name: Install yq
run: |
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
sudo chmod +x /usr/local/bin/yq

- name: Helm registry login
run: |
echo "${{ secrets.DOCKERHUB_ZXPORTER_BALANCE_TOKEN }}" | \
helm registry login registry-1.docker.io \
--username "${{ secrets.DOCKERHUB_ZXPORTER_BALANCE_USERNAME }}" \
--password-stdin

- name: Enable Helm OCI support
run: echo "HELM_EXPERIMENTAL_OCI=1" >> $GITHUB_ENV

- name: Fetch tags
run: git fetch --tags

- name: Bump patch version
id: version
run: |
LAST_TAG=$(git tag --list '${{ env.CHART_TAG_PREFIX }}*' --sort=-v:refname | head -n 1)
if [ -z "$LAST_TAG" ]; then
LAST_VERSION="0.0.0"
else
LAST_VERSION="${LAST_TAG#${{ env.CHART_TAG_PREFIX }}}"
fi
IFS='.' read -r MAJOR MINOR PATCH <<< "$LAST_VERSION"
PATCH=$((PATCH + 1))
NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
echo "Auto-releasing chart patch: $LAST_VERSION → $NEW_VERSION (triggered by: ${{ github.event.head_commit.message }})"

- name: Create and push chart tag
run: |
git config --global user.email "actions@github.com"
git config --global user.name "GitHub Actions"
git tag "${{ env.CHART_TAG_PREFIX }}${{ steps.version.outputs.new_version }}"
git push origin "${{ env.CHART_TAG_PREFIX }}${{ steps.version.outputs.new_version }}"

- name: Update chart dependencies
run: helm dependency update helm-chart/zxporter

- name: Lint Helm chart
run: helm lint helm-chart/zxporter

- name: Package Helm chart
run: |
mkdir -p helm-chart/packages
helm package helm-chart/zxporter \
--version ${{ steps.version.outputs.new_version }} \
--app-version ${{ steps.version.outputs.new_version }} \
--destination helm-chart/packages

- name: Push chart to Docker Hub OCI registry
run: |
helm push helm-chart/packages/zxporter-${{ steps.version.outputs.new_version }}.tgz \
oci://${{ env.REGISTRY }}/${{ env.ORG }}

- name: Update Chart.yaml version and appVersion
run: |
yq e -i '.version = "${{ steps.version.outputs.new_version }}"' helm-chart/zxporter/Chart.yaml
yq e -i '.appVersion = "${{ steps.version.outputs.new_version }}"' helm-chart/zxporter/Chart.yaml

- name: Create PR to update Chart.yaml
uses: peter-evans/create-pull-request@v6
with:
commit-message: "chore(helm): update Chart.yaml version to ${{ steps.version.outputs.new_version }}"
title: "chore(helm): update Chart.yaml version to ${{ steps.version.outputs.new_version }}"
body: |
Automated patch release triggered by changes to `helm-chart/zxporter/`.

This PR updates `version` and `appVersion` in `helm-chart/zxporter/Chart.yaml` to `${{ steps.version.outputs.new_version }}`.

Triggered by commit: ${{ github.event.head_commit.message }}
branch: "update/chart-version-${{ steps.version.outputs.new_version }}"
add-paths: |
helm-chart/zxporter/Chart.yaml
59 changes: 59 additions & 0 deletions .github/workflows/helm-chart-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
name: Helm Chart Validation

on:
pull_request:
paths:
- 'helm-chart/zxporter/**'
- 'helm-chart/zxporter-netmon/**'
workflow_dispatch:

jobs:
validate-zxporter:
name: Lint & template zxporter chart
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Set up Helm
uses: azure/setup-helm@v4
with:
version: '3.12.3'

- name: Update chart dependencies
run: helm dependency update helm-chart/zxporter

- name: Lint chart
run: helm lint helm-chart/zxporter

- name: Template render check
run: |
helm template zxporter helm-chart/zxporter \
--set zxporter.clusterToken=ci-test-token \
--set zxporter.kubeContextName=ci-test-cluster \
--set zxporter.k8sProvider=other \
> /dev/null
echo "zxporter chart rendered successfully"

validate-netmon:
Comment on lines +12 to +38

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 2 months ago

In general, to fix this class of problem you add a permissions block either at the root of the workflow (applies to all jobs unless overridden) or per job, and set only the minimal scopes needed (typically contents: read for simple CI jobs that just check out code).

For this specific workflow, both jobs only check out the code and run Helm commands; they don’t interact with issues, PRs, or perform any repository writes. The single best fix is therefore to add a root-level permissions section right under the name: (and before on:), setting contents: read. This will apply to both validate-zxporter and validate-netmon without altering existing behavior. No additional imports or methods are required, because this is a YAML configuration change only.

Concretely, in .github/workflows/helm-chart-validation.yml, insert:

permissions:
  contents: read

between line 1 (name: Helm Chart Validation) and line 3 (on:). No other changes are necessary.

Suggested changeset 1
.github/workflows/helm-chart-validation.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/helm-chart-validation.yml b/.github/workflows/helm-chart-validation.yml
--- a/.github/workflows/helm-chart-validation.yml
+++ b/.github/workflows/helm-chart-validation.yml
@@ -1,5 +1,8 @@
 name: Helm Chart Validation
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     paths:
EOF
@@ -1,5 +1,8 @@
name: Helm Chart Validation

permissions:
contents: read

on:
pull_request:
paths:
Copilot is powered by AI and may make mistakes. Always verify output.
name: Lint & template zxporter-netmon chart
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Set up Helm
uses: azure/setup-helm@v4
with:
version: '3.12.3'

- name: Update chart dependencies
run: helm dependency update helm-chart/zxporter-netmon

- name: Lint chart
run: helm lint helm-chart/zxporter-netmon

- name: Template render check
run: |
helm template zxporter-netmon helm-chart/zxporter-netmon > /dev/null
echo "zxporter-netmon chart rendered successfully"
Comment on lines +39 to +59

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 2 months ago

In general, the fix is to explicitly set a restrictive permissions: block for the workflow or individual jobs so the GITHUB_TOKEN has only the minimal scopes required. For this Helm validation workflow, the jobs just need to read repository contents (to check out code and charts) and do not interact with issues, PRs, or perform any writes, so contents: read at the workflow root is sufficient.

The best fix without changing existing functionality is to add a single root-level permissions: block after the on: section. This will apply to both validate-zxporter and validate-netmon jobs since they do not define their own permissions:. No other logic, steps, or actions need to be modified. Concretely, in .github/workflows/helm-chart-validation.yml, add:

permissions:
  contents: read

between the on: block (ending at line 8) and the jobs: key (line 10). No additional imports or definitions are required because this is purely a YAML configuration change for GitHub Actions.

Suggested changeset 1
.github/workflows/helm-chart-validation.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/helm-chart-validation.yml b/.github/workflows/helm-chart-validation.yml
--- a/.github/workflows/helm-chart-validation.yml
+++ b/.github/workflows/helm-chart-validation.yml
@@ -7,6 +7,9 @@
       - 'helm-chart/zxporter-netmon/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate-zxporter:
     name: Lint & template zxporter chart
EOF
@@ -7,6 +7,9 @@
- 'helm-chart/zxporter-netmon/**'
workflow_dispatch:

permissions:
contents: read

jobs:
validate-zxporter:
name: Lint & template zxporter chart
Copilot is powered by AI and may make mistakes. Always verify output.
Loading