name: Release Helm Chart and Carvel package

on:
  push:
    paths:
      # update this file to trigger helm chart release
      - 'helm/sealed-secrets/Chart.yaml'
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "$GITHUB_ACTOR"
          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"

      - name: Install Helm
        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
        with:
          version: v4.1.1

      - name: Run chart-releaser
        uses: helm/chart-releaser-action@98bccfd32b0f76149d188912ac8e45ddd3f8695f # v1.4.1
        with:
          charts_dir: helm
        env:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
          CR_RELEASE_NAME_TEMPLATE: "helm-v{{ .Version }}"

      - name: Install Carvel
        uses: carvel-dev/setup-action@a11507416d8fea298e923fe4356f4e4f4097f15b # v1.3.0
        with:
          only: kbld, imgpkg
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install yq
        run: |
          mkdir -p ~/bin
          wget https://github.com/mikefarah/yq/releases/download/v4.30.8/yq_linux_amd64 -O ~/bin/yq
          chmod +x ~/bin/yq

      - name: Get chart version
        run: |
          export PATH=~/bin:$PATH
          echo "chart_version=$(yq .version < ./helm/sealed-secrets/Chart.yaml)" >> $GITHUB_ENV

      - name: Configure DNS for registry access
        run: |
          echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf > /dev/null
          echo "nameserver 8.8.4.4" | sudo tee -a /etc/resolv.conf > /dev/null

      - name: OCI Push
        env:
          OCI_PASS: ${{ secrets.OCI_PASSWORD }}
          OCI_USR: ${{ secrets.OCI_USERNAME }}
          HELM_EXPERIMENTAL_OCI: 1
        run: |
          echo $OCI_PASS | helm registry login -u $OCI_USR --password-stdin registry-1.docker.io
          helm package helm/sealed-secrets/
          helm push sealed-secrets-${{ env.chart_version }}.tgz oci://registry-1.docker.io/bitnamicharts

      - name: Create imglock file
        working-directory: ./helm
        run: |
          mkdir -p .imgpkg
          kbld -f <(helm template sealed-secrets) --imgpkg-lock-output .imgpkg/images.yml

      - name: Push imgpkg bundle
        working-directory: ./helm
        env:
          IMGPKG_REGISTRY_HOSTNAME: ghcr.io
          IMGPKG_REGISTRY_USERNAME: ${{ github.actor }}
          IMGPKG_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        run: |
          imgpkg push -b ghcr.io/${{ github.repository_owner }}/sealed-secrets-carvel:${{ env.chart_version }} -f . --json > output
          echo carvel_pkg=$(cat output | grep Pushed | cut -d "'" -f2 ) >> $GITHUB_ENV

      - name: Update package.yaml
        run: |
          yq -i '.spec.version = "${{ env.chart_version }}"' carvel/package.yaml
          yq -i '.metadata.name = "sealedsecrets.bitnami.com.${{ env.chart_version }}"' carvel/package.yaml
          yq -i '.spec.template.spec.fetch.0.imgpkgBundle.image = "${{ env.carvel_pkg }}"' carvel/package.yaml
          git checkout -B 'release-carvel-${{ env.chart_version }}'
          git add carvel/package.yaml
          git commit -sm 'Release carvel package ${{ env.chart_version }}'
          git push origin 'release-carvel-${{ env.chart_version }}'

      - name: Create PR
        run: gh pr create --fill --base main --repo $GITHUB_REPOSITORY
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
