Skip to content

PR #20 — feat: replace plausible analytics with opentelemetry browser instrumentation #31

PR #20 — feat: replace plausible analytics with opentelemetry browser instrumentation

PR #20 — feat: replace plausible analytics with opentelemetry browser instrumentation #31

Workflow file for this run

name: "[CI] Lint, build & publish"
# PR runs show PR title; main runs show head commit subject.
run-name: >-
${{ github.event_name == 'pull_request'
&& format('PR #{0} — {1}', github.event.pull_request.number, github.event.pull_request.title)
|| format('Head build — {0}', github.event.head_commit.message) }}
on:
push:
branches: [main]
pull_request:
branches: [main]
env:
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
# Default to least privilege; jobs elevate only when needed.
permissions:
contents: read
jobs:
# Chart quality gate
helm-lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: azure/setup-helm@v5
- name: Install kubeconform
run: |
curl -sSL https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz \
| sudo tar xz -C /usr/local/bin kubeconform
- name: Lint, template-render & validate chart
run: |
helm lint charts/
helm template test charts/ \
| kubeconform -strict -summary \
-schema-location default \
-schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
-ignore-missing-schemas
# Container image build/publish (reusable workflow)
build-conversion-guide:
uses: bcit-tlu/.github/.github/workflows/oci-build.yaml@main
permissions:
contents: read
packages: write
id-token: write
security-events: write
actions: read
with:
component: conversion-guide
image_name: conversion-guide
context: .
tag_prefix: "v"
secrets: inherit
# Publish chart from main pushes using the image RC version.
helm-publish:
needs: [helm-lint, build-conversion-guide]
if: >-
github.event_name != 'pull_request'
&& needs.build-conversion-guide.outputs.rc_version != ''
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
id-token: write
env:
REGISTRY: ghcr.io
steps:
- uses: actions/checkout@v6
- uses: azure/setup-helm@v5
- uses: sigstore/cosign-installer@v3
- name: Cosign login (OCI)
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REGISTRY: ${{ env.REGISTRY }}
ACTOR: ${{ github.actor }}
run: |
echo "${GITHUB_TOKEN}" | \
cosign login "${REGISTRY}" \
-u "${ACTOR}" \
--password-stdin
- name: Helm login (OCI)
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REGISTRY: ${{ env.REGISTRY }}
ACTOR: ${{ github.actor }}
run: |
echo "${GITHUB_TOKEN}" | \
helm registry login "${REGISTRY}" \
-u "${ACTOR}" \
--password-stdin
- name: Package, push & sign chart
shell: bash
env:
VERSION: ${{ needs.build-conversion-guide.outputs.rc_version }}
OCI_BASE: oci://${{ env.REGISTRY }}/${{ github.repository }}/charts
IMAGE_BASE: ${{ env.REGISTRY }}/${{ github.repository }}/charts
run: |
set -euo pipefail
CHART_DIR="charts"
CHART_NAME=$(yq '.name' "${CHART_DIR}/Chart.yaml")
DEST_DIR="/tmp/charts"
mkdir -p "${DEST_DIR}"
helm package "${CHART_DIR}" \
--version "${VERSION}" \
--app-version "${VERSION}" \
-d "${DEST_DIR}"
PUSH_OUT=$(helm push \
"${DEST_DIR}/${CHART_NAME}-${VERSION}.tgz" \
"${OCI_BASE}" 2>&1) || { echo "${PUSH_OUT}"; exit 1; }
echo "${PUSH_OUT}"
# Tolerant digest parse: case-insensitive, allows leading whitespace.
DIGEST=$(printf '%s\n' "${PUSH_OUT}" \
| awk 'tolower($1)=="digest:"{print $2; exit}')
if [[ -z "${DIGEST}" ]]; then
echo "::error::helm push for ${CHART_NAME} succeeded but no digest found in output (helm output format may have changed)"
exit 1
fi
cosign sign --yes "${IMAGE_BASE}/${CHART_NAME}@${DIGEST}"