Repository: kubernetes-sigs/security-profiles-operator
Pull request #1067 (2022-08-03 21:05:37)

helm: Package and save chart in a GitHub release.
#### What type of PR is this?
/kind cleanup

#### What this PR does / why we need it:
This adds a GitHub Actions workflow that runs "helm package"
on the helm chart and saves it as a workflow artifact. If the
workflow was triggered by a GitHub release being published,
it automatically adds the package to the release that triggered
the workflow.

Note: The package is only attached to a release when it is
published. A draft release will not trigger the workflow.
Refer to the GitHub documentation for more information:
https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release

The reason for running "helm package" on both pull requests
and release-publishings is to ensure a change introduced in
a PR does not break the workflow automation (it would be very
unfortunate to discover that the workflow broke when we create
a GitHub release).

#### Which issue(s) this PR fixes:
None

#### Does this PR have test?
The workflow tests that "helm package" creates a file and that
the file exists. The GitHub "upload-artifact" action is configured
to fail if it cannot find a file to upload (sadly, like GitLab, this is not
the default behavior).

#### Special notes for your reviewer:
I spoke with @saschagrunert and @JAORMX about the automation
working this way (that is: packaging the chart and attaching it to
an existing release).

#### Does this PR introduce a user-facing change?

```release-note
NONE
```

k8s-ci-robot: Hi @stephen-fox. Thanks for your PR.

I'm waiting for a [kubernetes-sigs](https://github.com/orgs/kubernetes-sigs/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://git.k8s.io/community/community-membership.md#member) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
</details>

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1067#" title="Author self-approved">stephen-fox</a>*
**Once this PR has been reviewed and has the lgtm label**, please assign pjbgf for approval by writing `/assign @pjbgf` in a comment. For more information see:[The Kubernetes Code Review Process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process).

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["pjbgf"]} -->
saschagrunert: /ok-to-test
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1067#pullrequestreview-1061348311" title="LGTM">saschagrunert</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1067#" title="Author self-approved">stephen-fox</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/.github/workflows/helm-chart-package.yaml b/.github/workflows/helm-chart-package.yaml
new file mode 100644
index 000000000..ca4b95a0d
--- /dev/null
+++ b/.github/workflows/helm-chart-package.yaml
@@ -0,0 +1,53 @@
+name: helm-chart-package
+on:
+  pull_request:
+  release:
+    types: [published]
+permissions:
+  actions: none
+  checks: none
+  contents: write
+  deployments: none
+  id-token: none
+  issues: none
+  discussions: none
+  packages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+jobs:
+  helm-package:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Set up Helm
+        uses: azure/setup-helm@v1
+        with:
+          version: v3.8.1
+      - run: mkdir -p build
+      - id: package
+        run: |
+          helm_output="$(helm package -d build deploy/helm)"
+          tgz_path="${helm_output##*saved it to: }"
+          echo "helm chart tgz path: '${tgz_path}'"
+          [ ! -f "${tgz_path}" ] && echo "failed to find helm chart from 'helm package' stdout" && exit 1
+          echo "::set-output name=helm_tgz_path::${tgz_path}"
+          echo "::set-output name=helm_tgz_name::${tgz_path##*/}"
+      - uses: actions/upload-artifact@v3
+        with:
+          name: ${{ steps.package.outputs.helm_tgz_name}}
+          path: ${{ steps.package.outputs.helm_tgz_path}}
+          if-no-files-found: error
+      - uses: actions/upload-release-asset@v1
+        if: github.event_name == 'release'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ github.event.release.upload_url }}
+          asset_path: ${{ steps.package.outputs.helm_tgz_path}}
+          asset_name: ${{ steps.package.outputs.helm_tgz_name}}
+          asset_content_type: 'application/x-tar'


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7e9714f49..35a3d1174 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,11 +29,11 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - uses: github/codeql-action/init@0c670bbf0414f39666df6ce8e718ec5662c21e03
+      - uses: github/codeql-action/init@2ca79b6fa8d3ec278944088b4aa5f46912db5d63
         with:
           languages: go
-      - uses: github/codeql-action/autobuild@0c670bbf0414f39666df6ce8e718ec5662c21e03
-      - uses: github/codeql-action/analyze@0c670bbf0414f39666df6ce8e718ec5662c21e03
+      - uses: github/codeql-action/autobuild@2ca79b6fa8d3ec278944088b4aa5f46912db5d63
+      - uses: github/codeql-action/analyze@2ca79b6fa8d3ec278944088b4aa5f46912db5d63
 
   coverage:
     runs-on: ubuntu-20.04