feat: Improve controller Dockerfile caching (#549) #10
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Retina Charts | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| permissions: | |
| contents: read | |
| packages: write | |
| # This is used to complete the identity challenge | |
| # with sigstore/fulcio when running outside of PRs. | |
| id-token: write | |
| jobs: | |
| push-retina-charts: | |
| name: Publish Retina Helm Charts | |
| runs-on: ubuntu-latest | |
| if: github.ref_type == 'tag' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: azure/setup-helm@v4.2.0 | |
| id: install | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3.6.0 | |
| - name: Log in to registry (Helm for pushing chart, Docker for signing and push signature) | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u $ --password-stdin | |
| echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin | |
| - name: Build, Push and Sign chart | |
| id: build_chart | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| export TAG=$(make version) | |
| helm package ./deploy/legacy/manifests/controller/helm/retina --version $TAG | |
| # Get Helm chart's SHA digest from helm push cmd output | |
| helm push retina-$TAG.tgz oci://ghcr.io/${{ github.repository }}/charts >> helm_push_result.txt 2>&1 | |
| cat helm_push_result.txt | |
| cosign sign --yes ghcr.io/${{ github.repository }}/charts/retina@$(tail -n 1 helm_push_result.txt | awk '{ print $2 }') | |