add helm chart publishing

Author: gilesknap

.github/workflows/_helm.yml

@@ -0,0 +1,57 @@
+name: Package helm charts
+
+on:
+  workflow_call:
+
+env:
+  HELM_VERSION_TO_INSTALL: 3.14.3
+
+jobs:
+  package-helm-charts:
+    name: Test helm chart packaging
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install helm
+        uses: Azure/setup-helm@v3
+        with:
+          version: ${{ env.HELM_VERSION_TO_INSTALL }}
+
+      # an early check for correct tag saves waiting for the build to find problems
+      - name: Check helm version tag
+        if: ${{ github.ref_type == 'tag' }}
+        env:
+          VERSION: "${{ github.ref_name }}"
+        run: |
+          set -xeuo pipefail
+
+          VERSION=${{ github.ref_name }}
+
+          # Check that alpha/beta versions have the form 2025.8.1+b1 requried by Helm
+          if [[ "${VERSION}" =~ '^[0-9]+\.[0-9]+\.[0-9]+(\+.*)?$' ]]; then
+              echo "Valid version format: ${VERSION}"
+          else
+              echo "Invalid version format: ${VERSION}. Expected format: X.Y.Z or X.Y.Z+string"
+              return 1
+          fi
+
+      - name: Package helm charts
+        env:
+          VERSION: "${{ github.ref_type == 'tag' && github.ref_name || '0.0.0' }}"
+        run: |
+          set -xeuo pipefail
+
+          mkdir -p charts
+          cd helm
+          helm package -u --app-version ${VERSION} --version ${VERSION} .
+          mv *.tgz ../../charts
+
+      - name: Upload helm charts as artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: charts
+          path: charts

.github/workflows/_release.yml

@@ -20,6 +20,17 @@ jobs:
             rm -rf $GITHUB_REF_NAME
           fi
 
+      - name: Push tagged helm chart to registry
+        run: |
+          set -x
+
+          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io/${{ github.repository_owner }} --username ${{ github.repository_owner }} --password-stdin
+
+          IFS='@' read -r NAME VERSION <<< "${GITHUB_REF_NAME}"
+          REGISTRY=oci://ghcr.io/diamondlightsource
+
+          helm push "${NAME}-${VERSION}.tgz" ${REGISTRY}
+
       - name: Create GitHub Release
         # We pin to the SHA, not the tag, for security reasons.
         # https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions

.github/workflows/ci.yml

@@ -51,9 +51,12 @@ jobs:
     permissions:
       id-token: write
 
+  helm:
+    uses: ./.github/workflows/_helm.yml
+
   release:
     if: github.ref_type == 'tag'
-    needs: [dist, docs]
+    needs: [dist, docs, helm]
     uses: ./.github/workflows/_release.yml
     permissions:
       contents: write

package-helm-chart.sh

@@ -0,0 +1,21 @@
+#!/bin/env bash
+
+set -xeuo pipefail
+
+FULL_REF=$(git describe --tags)
+VERSION="${FULL_REF#*@}"
+
+# Check that alpha/beta versions have the form 2025.8.1+b1 requried by Helm
+if [[ "${VERSION}" =~ '^[0-9]+\.[0-9]+\.[0-9]+(\+.*)?$' ]]; then
+    echo "Valid version format: ${VERSION}"
+else
+    echo "Invalid version format: ${VERSION}. Expected format: X.Y.Z or X.Y.Z+string"
+    return 1
+fi
+
+mkdir -p charts
+
+cd helm
+
+helm package -u --app-version ${VERSION} --version ${VERSION} .
+mv *.tgz ../../charts