PR #20 — feat: replace plausible analytics with opentelemetry browser instrumentation #31
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "[CI] Lint, build & publish" | |
| # PR runs show PR title; main runs show head commit subject. | |
| run-name: >- | |
| ${{ github.event_name == 'pull_request' | |
| && format('PR #{0} — {1}', github.event.pull_request.number, github.event.pull_request.title) | |
| || format('Head build — {0}', github.event.head_commit.message) }} | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| # Default to least privilege; jobs elevate only when needed. | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Chart quality gate | |
| helm-lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: azure/setup-helm@v5 | |
| - name: Install kubeconform | |
| run: | | |
| curl -sSL https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz \ | |
| | sudo tar xz -C /usr/local/bin kubeconform | |
| - name: Lint, template-render & validate chart | |
| run: | | |
| helm lint charts/ | |
| helm template test charts/ \ | |
| | kubeconform -strict -summary \ | |
| -schema-location default \ | |
| -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \ | |
| -ignore-missing-schemas | |
| # Container image build/publish (reusable workflow) | |
| build-conversion-guide: | |
| uses: bcit-tlu/.github/.github/workflows/oci-build.yaml@main | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| security-events: write | |
| actions: read | |
| with: | |
| component: conversion-guide | |
| image_name: conversion-guide | |
| context: . | |
| tag_prefix: "v" | |
| secrets: inherit | |
| # Publish chart from main pushes using the image RC version. | |
| helm-publish: | |
| needs: [helm-lint, build-conversion-guide] | |
| if: >- | |
| github.event_name != 'pull_request' | |
| && needs.build-conversion-guide.outputs.rc_version != '' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| env: | |
| REGISTRY: ghcr.io | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: azure/setup-helm@v5 | |
| - uses: sigstore/cosign-installer@v3 | |
| - name: Cosign login (OCI) | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REGISTRY: ${{ env.REGISTRY }} | |
| ACTOR: ${{ github.actor }} | |
| run: | | |
| echo "${GITHUB_TOKEN}" | \ | |
| cosign login "${REGISTRY}" \ | |
| -u "${ACTOR}" \ | |
| --password-stdin | |
| - name: Helm login (OCI) | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REGISTRY: ${{ env.REGISTRY }} | |
| ACTOR: ${{ github.actor }} | |
| run: | | |
| echo "${GITHUB_TOKEN}" | \ | |
| helm registry login "${REGISTRY}" \ | |
| -u "${ACTOR}" \ | |
| --password-stdin | |
| - name: Package, push & sign chart | |
| shell: bash | |
| env: | |
| VERSION: ${{ needs.build-conversion-guide.outputs.rc_version }} | |
| OCI_BASE: oci://${{ env.REGISTRY }}/${{ github.repository }}/charts | |
| IMAGE_BASE: ${{ env.REGISTRY }}/${{ github.repository }}/charts | |
| run: | | |
| set -euo pipefail | |
| CHART_DIR="charts" | |
| CHART_NAME=$(yq '.name' "${CHART_DIR}/Chart.yaml") | |
| DEST_DIR="/tmp/charts" | |
| mkdir -p "${DEST_DIR}" | |
| helm package "${CHART_DIR}" \ | |
| --version "${VERSION}" \ | |
| --app-version "${VERSION}" \ | |
| -d "${DEST_DIR}" | |
| PUSH_OUT=$(helm push \ | |
| "${DEST_DIR}/${CHART_NAME}-${VERSION}.tgz" \ | |
| "${OCI_BASE}" 2>&1) || { echo "${PUSH_OUT}"; exit 1; } | |
| echo "${PUSH_OUT}" | |
| # Tolerant digest parse: case-insensitive, allows leading whitespace. | |
| DIGEST=$(printf '%s\n' "${PUSH_OUT}" \ | |
| | awk 'tolower($1)=="digest:"{print $2; exit}') | |
| if [[ -z "${DIGEST}" ]]; then | |
| echo "::error::helm push for ${CHART_NAME} succeeded but no digest found in output (helm output format may have changed)" | |
| exit 1 | |
| fi | |
| cosign sign --yes "${IMAGE_BASE}/${CHART_NAME}@${DIGEST}" |