jklein
0fb6c30466
Two defects kept the publish broken after the load-secrets-action v5 bump in #140. v5 no longer exports the loaded values as environment variables for later steps the way v4 did; only the step outputs carry them. Every "${{ env.JK_CR_* }}" reference therefore resolved to an empty string from that bump on, and nothing reported it - the loading step logs "Populating variable" and stays green either way. #149 moved three of the four references to steps.<id>.outputs but left "-u ${{ env.JK_CR_USERNAME }}" on the old form, and piped the username instead of the token into --password-stdin. The second defect is why this surfaced as a terminal error: an empty value collapsed into a missing argument instead of failing. With an empty username, "-u" swallowed the following "--password-stdin", helm stopped reading the password from stdin, prompted interactively and died with "inappropriate ioctl for device". All four values now come from steps.<id>.outputs, are mapped into each step's own env block and used as quoted shell variables guarded with ":?". An empty or unset value aborts the job naming the op:// path to fix, quoting keeps it from shifting arguments, and the token no longer appears on the command line.
105 lines
4.7 KiB
YAML
105 lines
4.7 KiB
YAML
name: Publish Helm Chart with patched Application Version
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
chart-location:
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
description: "location of the helm chart directory"
|
|
chart-name:
|
|
required: true
|
|
type: string
|
|
description: "name of the helm chart"
|
|
workflow_call:
|
|
inputs:
|
|
chart-location:
|
|
required: false
|
|
type: string
|
|
default: "."
|
|
description: "location of the helm chart directory"
|
|
chart-name:
|
|
required: true
|
|
type: string
|
|
description: "name of the helm chart"
|
|
outputs:
|
|
chart-version:
|
|
description: "the version of the published helm chart"
|
|
value: ${{ jobs.publish-helm-chart.outputs.chart-version }}
|
|
secrets:
|
|
OP_CONNECT_TOKEN:
|
|
required: true
|
|
jobs:
|
|
publish-helm-chart:
|
|
outputs:
|
|
chart-version: ${{ steps.get-chart-version.outputs.CHART_VERSION }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: "Checkout Repository"
|
|
uses: actions/checkout@v7
|
|
- name: "Install Helm"
|
|
uses: azure/setup-helm@v5
|
|
- name: "Configure OP-Connect"
|
|
uses: 1password/load-secrets-action/configure@v5
|
|
with:
|
|
connect-host: https://op-connect.jk-dev.de
|
|
- name: "Package Helm Chart"
|
|
run: helm package ${{ inputs.chart-name }}
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "Get Helm Chart Version"
|
|
id: get-chart-version
|
|
run: |-
|
|
CHART_VERSION=$(grep '^version:' ${{ inputs.chart-name}}/Chart.yaml | awk '{print $2}')
|
|
echo $CHART_VERSION
|
|
echo "CHART_VERSION=$CHART_VERSION" >> $GITHUB_OUTPUT
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "Load Helm Registry Credentials"
|
|
id: load-jk-cr-creds
|
|
uses: 1password/load-secrets-action@v5
|
|
env:
|
|
OP_CONNECT_TOKEN: ${{ secrets.OP_CONNECT_TOKEN }}
|
|
JK_CR_TOKEN: op://GitHub-Actions/jk-registry-access/password
|
|
JK_CR_USERNAME: op://GitHub-Actions/jk-registry-access/username
|
|
JK_CR_CHARTS_LOCATION: op://GitHub-Actions/jk-registry-access/charts-location
|
|
JK_CR_HELM_REGISTRY: op://GitHub-Actions/jk-registry-access/helm-registry
|
|
# The values are mapped into each step's own env block and read as quoted
|
|
# shell variables - never interpolated into the command line.
|
|
#
|
|
# Two separate failures made this necessary. First, load-secrets-action v5
|
|
# (bumped in #140) no longer exports the loaded values as environment
|
|
# variables for later steps the way v4 did; only the step outputs carry
|
|
# them. Every "${{ env.JK_CR_* }}" reference therefore resolved to an empty
|
|
# string from that bump on, with nothing reporting an error - the loading
|
|
# step logs "Populating variable" and stays green either way.
|
|
#
|
|
# Second, an empty value collapsed into a missing argument instead of an
|
|
# error: with an empty username, "-u" swallowed the following
|
|
# "--password-stdin", helm stopped reading the password from stdin,
|
|
# prompted interactively and died on the runner with "inappropriate ioctl
|
|
# for device" - a terminal error for what was really an unset variable.
|
|
#
|
|
# The ":?" guards fail loudly and name the value that is missing, quoting
|
|
# keeps an empty one from shifting arguments, and the token no longer
|
|
# appears in the process list.
|
|
- name: "Login to JK-Registry"
|
|
env:
|
|
JK_CR_TOKEN: ${{ steps.load-jk-cr-creds.outputs.JK_CR_TOKEN }}
|
|
JK_CR_USERNAME: ${{ steps.load-jk-cr-creds.outputs.JK_CR_USERNAME }}
|
|
JK_CR_HELM_REGISTRY: ${{ steps.load-jk-cr-creds.outputs.JK_CR_HELM_REGISTRY }}
|
|
run: |-
|
|
: "${JK_CR_HELM_REGISTRY:?empty - check op://GitHub-Actions/jk-registry-access/helm-registry}"
|
|
: "${JK_CR_USERNAME:?empty - check op://GitHub-Actions/jk-registry-access/username}"
|
|
: "${JK_CR_TOKEN:?empty - check op://GitHub-Actions/jk-registry-access/password}"
|
|
printf '%s' "$JK_CR_TOKEN" | helm registry login "$JK_CR_HELM_REGISTRY" -u "$JK_CR_USERNAME" --password-stdin
|
|
- name: "Push Helm Chart to JK-Container Registry"
|
|
env:
|
|
JK_CR_CHARTS_LOCATION: ${{ steps.load-jk-cr-creds.outputs.JK_CR_CHARTS_LOCATION }}
|
|
run: |-
|
|
: "${JK_CR_CHARTS_LOCATION:?empty - check op://GitHub-Actions/jk-registry-access/charts-location}"
|
|
helm push "${{ inputs.chart-name }}"-*.tgz "$JK_CR_CHARTS_LOCATION"
|
|
working-directory: ${{ inputs.chart-location }}
|
|
- name: "Logout from JK-Registry"
|
|
env:
|
|
JK_CR_HELM_REGISTRY: ${{ steps.load-jk-cr-creds.outputs.JK_CR_HELM_REGISTRY }}
|
|
run: helm registry logout "$JK_CR_HELM_REGISTRY"
|