name: Release chart
# Triggered by `git tag chart/vX.Y.Z && git push --tags`, independently of
# image releases — see docs/versioning.md. Never bumps the image: Chart.yaml's
# committed appVersion (last set by release-image.yaml) is what gets packaged,
# so a chart-only release always pins the last released image, never `latest`.
#
# Chart version is pure SemVer, deliberately WITHOUT the `+up<aptly>` build
# metadata bookstack-chart uses: Helm rewrites `+` to `_` on OCI push (and
# back on pull), which breaks listing in some third-party tooling (e.g.
# Rancher). The aptly version lives in appVersion instead.
on:
  push:
    tags:
      - 'chart/v*'

concurrency:
  group: release-chart
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Parse chart version from tag
        id: version
        run: echo "version=${GITEA_REF_NAME#chart/v}" >> "$GITEA_OUTPUT"
        env:
          GITEA_REF_NAME: ${{ gitea.ref_name }}

      - uses: azure/setup-helm@v4.3.0
        with:
          version: ${{ vars.HELM_VERSION || '3.16.4' }}

      - name: Quality gate
        run: |
          set -e
          helm lint charts/aptly
          for f in charts/aptly/ci/*.yaml; do
            helm template test charts/aptly -f "$f" > /dev/null
          done

      - name: Idempotency check — refuse to overwrite an existing chart version
        run: |
          if helm show chart "oci://git.morlana.online/f.weber/aptly" --version "${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
            echo "::error::chart version ${{ steps.version.outputs.version }} already exists in the registry. Bump the version and re-tag — this workflow never overwrites a published chart."
            exit 1
          fi

      - name: Import GPG signing key
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
          trust_level: 5

      - name: Build legacy secret keyring (helm package --sign wants gpg1-style secring.gpg)
        run: |
          mkdir -p /tmp/gpgring
          gpg --batch --pinentry-mode loopback --passphrase "${{ secrets.GPG_PASSPHRASE }}" \
            --export-secret-keys > /tmp/gpgring/secring.gpg
          printf '%s' "${{ secrets.GPG_PASSPHRASE }}" > /tmp/gpgring/passphrase.txt
          chmod 600 /tmp/gpgring/*

      # secrets.GPG_KEY_ID/GPG_PRIVATE_KEY must be an RSA (or other classic,
      # non-EdDSA) key — Helm's sign/verify uses the deprecated
      # golang.org/x/crypto/openpgp library, which cannot read Ed25519 keys at
      # all (fails with "private key not found"). See pubkeys/README.md.
      - name: Package & sign
        run: |
          helm package charts/aptly \
            --version "${{ steps.version.outputs.version }}" \
            --dependency-update \
            --sign --key "${{ secrets.GPG_KEY_ID }}" \
            --keyring /tmp/gpgring/secring.gpg \
            --passphrase-file /tmp/gpgring/passphrase.txt

      - name: helm registry login & push
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | helm registry login git.morlana.online \
            --username "${{ secrets.REGISTRY_USER }}" --password-stdin
          helm push "aptly-${{ steps.version.outputs.version }}.tgz" oci://git.morlana.online/f.weber

      - name: Create Gitea release with chart artifacts
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ gitea.ref_name }}
          name: "aptly chart ${{ steps.version.outputs.version }}"
          body: |
            `helm pull oci://git.morlana.online/f.weber/aptly --version ${{ steps.version.outputs.version }}`
          files: |
            aptly-${{ steps.version.outputs.version }}.tgz
            aptly-${{ steps.version.outputs.version }}.tgz.prov
            pubkeys/chart-signing.asc

      - name: Clean up key material
        if: always()
        run: rm -rf /tmp/gpgring