action.yml

name: Upload Helm Charts
description: Package and upload helm charts to AWS
inputs:
  registry-alias:
    default: ${{ github.repository_owner }}
    required: false
    description: repository alias
  repository:
    default: ${{ github.event.repository.name }}
    required: false
    description: repository name
  aws-region:
    default: "us-east-1"
    required: false
    description: aws region
  role-duration-seconds:
    default: "900"
    required: false
    description: aws role duration
  role-arn:
    default: ""
    required: false
    description: aws role arn to access ecr
  role-session-name:
    default: ""
    required: false
    description: aws role name to access resources
  role-skip-session-tagging:
    default: "false"
    required: false
    description: skip role session tagging
  helm-registry:
    default: "ECR"
    required: false
    description: helm repository
  chart-name:
    default: ""
    required: false
    description: specific chart name to package and publish
  charts-path:
    default: "charts"
    required: true
    description: path to charts folder
  chart-version:
    default: ""
    required: false
    description: optional chart version to update
  helm-push-extra:
    default: ""
    required: false
    description: extra parameters for helm push command
  lifecycle-policy:
    required: true
    description: lifecycle policy for repository, default policy is to delete untagged images in 3 days
    default: |
      {
        "rules": [
          {
            "rulePriority": 1,
            "description": "clean untagged",
            "selection": {
              "tagStatus": "untagged",
              "countType": "sinceImagePushed",
              "countUnit": "days",
              "countNumber": 3
            },
            "action": {
              "type": "expire"
            }
          }
        ]
      }

runs:
  using: composite
  steps:

    - name: Check current role
      if: ${{ inputs.helm-registry == 'ECR' || startsWith(inputs.helm-registry, 's3://')}}
      id: get-role
      shell: bash
      run: |
        aws sts get-caller-identity --query Arn --output text \
          | sed -r 's~^(.*):assumed-role/([^/]*)/.*~current_role=\1:role/\2~; s/:sts:/:iam:/' \
          | tee -a $GITHUB_OUTPUT

    - name: Configure AWS Credentials
      if: ${{ (inputs.helm-registry == 'ECR' || startsWith(inputs.helm-registry, 's3://')) && steps.get-role.outputs.current_role != inputs.role-arn }}
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ inputs.role-arn }}
        role-session-name: ${{ inputs.role-session-name }}
        aws-region: ${{ inputs.aws-region }}
        role-skip-session-tagging: ${{ inputs.role-skip-session-tagging }}
        role-duration-seconds: ${{ inputs.role-duration-seconds }}
        role-chaining: true

    - name: Login to Amazon ECR
      if: ${{ inputs.helm-registry == 'ECR' }}
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2
      with:
        mask-password: true

    - name: Set env values
      env:
        HELM_REGISTRY: ${{ inputs.helm-registry == 'ECR' && steps.login-ecr.outputs.registry || inputs.helm-registry }}
      shell: bash
      run: |
        if [ "${{ inputs.helm-registry }}" = "ECR" ] ; then
          HELM_REGISTRY="oci://${HELM_REGISTRY}"
        fi
        if [ -n "${HELM_REGISTRY}" ] ; then
          HELM_REGISTRY="${HELM_REGISTRY%/}/"
        fi
        echo "HELM_REGISTRY=${HELM_REGISTRY}" >> $GITHUB_ENV

    - name: Install s3 plugin
      if: startsWith(inputs.helm-registry, 's3://')
      shell: bash
      run: |
        set -x +e
        helm s3 version || \
          helm plugin install https://github.com/hypnoglow/helm-s3.git

    - name: Package helm charts
      shell: bash
      run: |
        set -ex
        PACKAGE_COMMAND_FLAGS=""
        if [ "${{ inputs.helm-registry }}" != "ECR" ] ; then
          helm repo add current-repo ${HELM_REGISTRY}
          helm repo update
          PACKAGE_COMMAND_FLAGS="--dependency-update --destination /tmp/.charts"
        fi
        cd ${{ inputs.charts-path }}
        if [ "${{ inputs.chart-version }}" != "" ] ; then
          PACKAGE_COMMAND_FLAGS="${PACKAGE_COMMAND_FLAGS} --version ${{ inputs.chart-version }}"
        fi
        if [[ "${{ inputs.chart-name }}" != "" ]]; then
          helm package ${{ inputs.chart-name }} $PACKAGE_COMMAND_FLAGS
        else
          find ./ -mindepth 1 -maxdepth 1 -type d | xargs helm package $PACKAGE_COMMAND_FLAGS
        fi

    - name: Create ECR repo if missing
      if: inputs.helm-registry == 'ECR' 
      shell: bash
      run: |
        set +o errexit
        aws ecr describe-repositories --repository-names ${{ inputs.registry-alias }}/${{ inputs.repository }}
        if [ $? -gt 0 ] ; then
          aws ecr create-repository --repository-name ${{ inputs.registry-alias }}/${{ inputs.repository }}
          aws ecr put-lifecycle-policy \
            --repository-name ${{ inputs.registry-alias }}/${{ inputs.repository }} \
            --lifecycle-policy-text '${{ inputs.lifecycle-policy }}'
        fi

    - name: Push to ECR repo
      id: push
      if: inputs.helm-registry == 'ECR'
      shell: bash
      run: |
        set -ex
        aws ecr get-login-password --region us-east-1 \
          | helm registry login --username AWS --password-stdin ${HELM_REGISTRY%/}
        for chart in /tmp/.charts/*.tgz ; do
          helm push ${{ inputs.helm-push-extra }} ${chart} oci://${HELM_REGISTRY%/}/${{ inputs.registry-alias }}/
        done

    - name: Upload to helm repo
      if: startsWith(inputs.helm-registry, 's3://')
      shell: bash
      run: |
        set -xe
        for chart in /tmp/.charts/*.tgz ; do
          helm s3 push ${{ inputs.helm-push-extra }} ${chart} current-repo
        done

    - name: Cleanup
      shell: bash
      run: helm repo remove current-repo