name: Helm

on:
  push:
    branches:
      - main
      - release-*
    paths:
      - 'deploy/charts/**'
      - 'deploy/crds'
  pull_request:
    paths:
      - 'deploy/charts/**'
      - 'deploy/crds'
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0

      - name: Generate chart
        run: |
          make helm.generate
      - name: Set up Helm
        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
        with:
          version: v3.4.2

      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
        with:
          python-version: 3.7

      - name: Set up chart-testing
        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1

      - name: Run chart-testing (list-changed)
        id: list-changed
        run: |
          changed=$(ct list-changed --config=.github/ci/ct.yaml)
          if [[ -n "$changed" ]]; then
            echo "changed=true" >> $GITHUB_OUTPUT
          fi
      - name: Install chart unittest
        run: |
          helm env
          helm plugin install https://github.com/helm-unittest/helm-unittest
      - name: Run chart-testing (lint)
        run: ct lint --config=.github/ci/ct.yaml

      - name: Create kind cluster
        uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
        if: steps.list-changed.outputs.changed == 'true'

      - name: Run chart-testing (install)
        run: ct install --config=.github/ci/ct.yaml --charts deploy/charts/external-secrets
        if: steps.list-changed.outputs.changed == 'true'

      - name: Run unitests
        if: steps.list-changed.outputs.changed == 'true'
        run: make helm.test

  release:
    permissions:
      contents: write  # for helm/chart-releaser-action to push chart release and create a release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
      - name: Set up Helm
        uses: azure/setup-helm@f382f75448129b3be48f8121b9857be18d815a82 # v3.4
        with:
          version: v3.4.2

      - name: Generate chart
        run: |
          make helm.generate
      - name: Import GPG key
        run: |
          echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --dearmor --output keyring.gpg
          echo "${{ secrets.GPG_PASSPHRASE }}" > passphrase-file.txt
      - name: Run chart-releaser
        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
        if: |
          github.ref == 'refs/heads/main' ||
          startsWith(github.ref, 'refs/heads/release-')
        env:
          CR_KEY: external-secrets <external-secrets@external-secrets.io>
          CR_KEYRING: keyring.gpg
          CR_PASSPHRASE_FILE: passphrase-file.txt
          CR_SIGN: true
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          CR_RELEASE_NAME_TEMPLATE: "helm-chart-{{ .Version }}"
        with:
          charts_dir: deploy/charts
          skip_existing: true
          charts_repo_url: https://charts.external-secrets.io