helm-publish.yml

name: Publish charts
permissions: read-all
on:
  push:
    tags:
      - "v*"
jobs:
  publish-helm:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
      packages: write
    outputs:
      chart-digest: ${{ steps.helm_publish.outputs.digest }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0
      - name: "Extract Version"
        id: extract_version
        run: |
          GIT_TAG=${GITHUB_REF##*/}
          VERSION=${GIT_TAG##v}
          echo "version=$(echo $VERSION)" >> $GITHUB_OUTPUT
      - name: Helm | Publish
        id: helm_publish
        uses: peak-scale/github-actions/helm-oci-chart@a441cca016861c546ab7e065277e40ce41a3eb84 # v0.2.0
        with:
          registry: ghcr.io
          repository: ${{ github.repository_owner }}/charts
          name: "cortex-proxy"
          path: "./charts/cortex-proxy/"
          app-version: ${{ steps.extract_version.outputs.version }}
          version: ${{ steps.extract_version.outputs.version }}
          registry-username: ${{ github.actor }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}
          update-dependencies: 'false' # Defaults to false
          sign-image: 'true'
          signature-repository: ghcr.io/${{ github.repository_owner }}/charts/cortex-proxy
  helm-provenance:
    needs: publish-helm
    permissions:
      id-token: write   # To sign the provenance.
      packages: write   # To upload assets to release.
      actions: read     # To read the workflow path.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
    with:
      image: ghcr.io/${{ github.repository_owner }}/charts/cortex-proxy
      digest: "${{ needs.publish-helm.outputs.chart-digest }}"
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}