release.yml

name: Release

on:
  push:
    tags:
      - trust-policies-v*

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write
    env:
      REGISTRY: ghcr.io
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - name: Extract Helm chart name and version
        id: release-details
        run: |
          # tag names are in the format <chart-name>-v<semantic-version>
          # so we need to extract the chart name
          release_name=$(echo -n ${{ github.ref_name }} | awk -F'-v' '{print $1}')
          echo release_name=$release_name >> $GITHUB_OUTPUT

          # extract the version from the tag name
          version=$(echo -n ${{ github.ref_name }} | sed "s/^$release_name-//")
          echo release_version=$version >> $GITHUB_OUTPUT
      - name: Package Helm chart
        run: helm package charts/${{ steps.release-details.outputs.release_name }}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Push packaged chart to GHCR
        run: helm push ${{ github.ref_name }}.tgz oci://${{ env.REGISTRY }}/${{ github.repository }}
      - uses: imjasonh/setup-crane@6da1ae018866400525525ce74ff892880c099987 # v0.5
      - name: Get pushed chart digest
        id: get-digest
        run: |
          digest=$(crane digest ${{ env.REGISTRY }}/${{ github.repository }}/${{ steps.release-details.outputs.release_name }}:${{ steps.release-details.outputs.release_version }})
          echo digest=$digest >> $GITHUB_OUTPUT
      - name: Attest
        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
        with:
          subject-name: ${{ env.REGISTRY }}/${{ github.repository }}/${{ steps.release-details.outputs.release_name }}
          subject-digest: ${{ steps.get-digest.outputs.digest }}
          push-to-registry: true