buzz/.github/workflows/helm-chart.yml

name: helm chart

# Lints + unit-tests + render-checks the chart on every PR/main push, and
# PUBLISHES it to GHCR as an OCI artifact on `chart-v*` tags.
#
# Publishing mirrors the relay image (see docker.yml): the chart is versioned
# independently of the desktop app and the relay via its own `chart-v*` tags
# (Chart.yaml `version`, cut by merging a `chart-release/<version>` PR). Only
# `chart-v*` tags publish — `main` pushes and PRs stay lint/render-only so we
# never overwrite a released chart version from an in-progress `main`.
#
# Why workflow_dispatch carries version/ref inputs:
#   Normal releases arrive through the `push.tags` trigger below. The inputs are
#   retained only for an operator to rerun publication manually at an immutable
#   chart tag; the publish job checks out inputs.ref and packages at
#   inputs.version.

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Chart semver e.g. 0.1.0 (no chart-v prefix) — for chart-tag rescue dispatch"
        required: false
      ref:
        description: "Chart tag ref to publish, e.g. chart-v0.1.0 (required when version is set)"
        required: false
        default: main
  push:
    # No `paths` filter here: GitHub applies a push `paths` filter to tag
    # pushes too, so a `chart-v*` tag whose commit didn't touch a chart file
    # would be filtered out and never publish. docker.yml / release.yml / sprig
    # all keep `paths` out of a tag-carrying `push` for exactly this reason —
    # PR runs stay scoped via `pull_request.paths` below; main pushes lint
    # unconditionally (cheap), and tag pushes always run so publish can fire.
    branches: [main]
    tags: ["chart-v[0-9]*"]
  pull_request:
    paths:
      - "deploy/charts/buzz/**"
      - "deploy/charts/buzz-push-gateway/**"
      - ".github/workflows/helm-chart.yml"
      - "ct.yaml"

# Match docker.yml: deny-by-default, each job grants only what it needs.
permissions: {}

env:
  # Single source of truth for the OCI chart repository (helm appends the chart
  # name `buzz`, yielding oci://ghcr.io/block/buzz/charts/buzz, which is exactly
  # the install ref documented in deploy/charts/buzz/README.md). Set
  # GHCR_CHART_REPO as a repo variable to override (e.g., forks pushing to their
  # own namespace without editing this file) — mirrors docker.yml's GHCR_IMAGE.
  CHART_REPO: ${{ vars.GHCR_CHART_REPO != '' && vars.GHCR_CHART_REPO || 'oci://ghcr.io/block/buzz/charts' }}

jobs:
  lint-and-unittest:
    name: lint + unittest + render matrix
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          # On chart-tag rescue dispatch, lint/render the tagged commit that the
          # publish job will package, not whatever `main` is when the dispatch
          # runs. Empty string = default ref for push/PR events.
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4  # v4.3.1
        with:
          version: v3.16.4

      - name: Install helm-unittest plugin
        run: helm plugin install --version 0.8.2 https://github.com/helm-unittest/helm-unittest

      - name: Set up Python (for chart-testing)
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: Set up chart-testing
        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b  # v2.7.0

      - name: Build chart dependencies
        run: helm dependency build deploy/charts/buzz

      - name: Push gateway chart lint + render guard
        run: deploy/charts/buzz-push-gateway/tests/render.sh

      - name: ct lint
        run: ct lint --config ct.yaml --all

      - name: helm-unittest
        run: helm unittest deploy/charts/buzz

      - name: helm template (render every fixture)
        run: |
          set -euo pipefail
          for f in deploy/charts/buzz/ci/*-values.yaml deploy/charts/buzz/tests/fixtures/*-values.yaml; do
            echo "::group::render $f"
            helm template buzz deploy/charts/buzz -f "$f"
            echo "::endgroup::"
          done

  install-on-kind:
    # Full end-to-end install requires the public ghcr.io/block/buzz image to
    # exist and to embed Max's startup migrations. Runs only after Sami's
    # image PR merges (`workflow_dispatch`) or on a schedule once main carries
    # both prerequisites. Render/lint above is the per-PR signal.
    #
    # `inputs.version == ''` excludes the chart-tag rescue dispatch (which
    # carries a version): that path only packages+publishes, it does not install.
    name: install on kind (gated)
    if: github.event_name == 'workflow_dispatch' && inputs.version == ''
    runs-on: ubuntu-latest
    needs: lint-and-unittest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - name: Set up Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4  # v4.3.1
        with:
          version: v3.16.4

      - name: Set up Python (for chart-testing)
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: Set up chart-testing
        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b  # v2.7.0

      - name: Create kind cluster
        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde  # v1.10.0
        with:
          version: v0.24.0
          node_image: kindest/node:v1.31.0

      - name: Build chart dependencies
        run: helm dependency build deploy/charts/buzz

      - name: ct install (quickstart profile)
        run: ct install --config ct.yaml --charts deploy/charts/buzz --helm-extra-args "--timeout 600s"

  publish:
    # Packages the chart and pushes it to GHCR as an OCI artifact. Fires only on
    # a `chart-v*` tag push or a manual rescue dispatch (which
    # carries inputs.version) — never on `main` pushes or PRs, so an in-progress
    # `main` can never overwrite a released chart version. Mirrors docker.yml's
    # GHCR publish (login with GITHUB_TOKEN, packages: write, fork override var).
    name: publish chart to GHCR
    if: >
      startsWith(github.ref, 'refs/tags/chart-v') ||
      (github.event_name == 'workflow_dispatch' && inputs.version != '')
    runs-on: ubuntu-latest
    needs: lint-and-unittest
    timeout-minutes: 15
    permissions:
      contents: read
      packages: write    # push the chart to GHCR
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          # On the rescue dispatch, build the tagged commit (github.ref is
          # `main` there); on a tag push, the default ref is already the tag.
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4  # v4.3.1
        with:
          version: v3.16.4

      - name: Resolve chart version
        id: ver
        env:
          # Bare on the rescue dispatch; empty on a tag push (derive from ref).
          INPUT_VERSION: ${{ inputs.version }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ -n "$INPUT_VERSION" ]; then
            version="$INPUT_VERSION"
            tag_ref="refs/tags/chart-v${version}"
            tag_sha="$(git rev-parse -q --verify "${tag_ref}^{commit}" || true)"
            head_sha="$(git rev-parse HEAD)"
            if [ -z "$tag_sha" ] || [ "$head_sha" != "$tag_sha" ]; then
              echo "::error::workflow_dispatch with version '$version' must check out matching tag 'chart-v${version}' (HEAD=$head_sha, tag=${tag_sha:-missing})"
              exit 1
            fi
          else
            # refs/tags/chart-v0.1.0 → github.ref_name is `chart-v0.1.0`.
            version="${REF_NAME#chart-v}"
          fi
          if ! echo "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
            echo "::error::Resolved chart version '$version' is not valid semver"
            exit 1
          fi
          # The tag is the source of truth, but the published artifact's version
          # comes from Chart.yaml — they must agree or we'd publish a mislabeled
          # chart. Fail loudly on drift rather than silently shipping a mismatch.
          chart_version="$(helm show chart deploy/charts/buzz | awk '/^version:/ {print $2}')"
          if [ "$chart_version" != "$version" ]; then
            echo "::error::Tag version '$version' != Chart.yaml version '$chart_version'. Bump Chart.yaml to match the tag."
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "Publishing chart version $version"

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build chart dependencies
        run: helm dependency build deploy/charts/buzz

      - name: Package chart
        run: helm package deploy/charts/buzz --destination dist

      - name: Push chart to GHCR
        env:
          CHART_REPO: ${{ env.CHART_REPO }}
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          set -euo pipefail
          helm push "dist/buzz-${VERSION}.tgz" "$CHART_REPO"

      - name: Summary
        env:
          CHART_REPO: ${{ env.CHART_REPO }}
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          # CHART_REPO is oci://ghcr.io/block/buzz/charts; helm push appends the
          # chart name, so the install ref is .../charts/buzz.
          INSTALL_REF="${CHART_REPO}/buzz"
          {
            echo "### Published chart \`buzz\` \`${VERSION}\`"
            echo
            echo "**OCI ref:** \`${INSTALL_REF}:${VERSION}\`"
            echo
            echo "Install:"
            echo '```'
            echo "helm install buzz ${INSTALL_REF} --version ${VERSION}"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"