aptly-containerized/.gitea/workflows/release-chart.yaml

name: Release chart
# Triggered by publishing a Gitea Release whose tag matches `chart/vX.Y.Z`
# (create the tag + release together via the Gitea UI's "New Release" page,
# or `git tag chart/vX.Y.Z && git push --tags` followed by turning that tag
# into a Release) — independently of image releases (release-image.yaml), see
# docs/versioning.md.
#
# Ticking "This is a pre-release" on that Gitea Release bakes
# `artifacthub.io/prerelease: "true"` into the packaged Chart.yaml (never
# committed back — see the "Set ArtifactHub prerelease annotation" step
# below), so ArtifactHub lists that specific chart version as a pre-release.
#
# This job also matches the `release: published` event fired by
# release-image.yaml's own auto-created Gitea Release for `image/v*` tags —
# the `if:` guard below skips anything whose tag isn't `chart/v*`.
#
# Chart version is pure SemVer, deliberately WITHOUT the `+up<aptly>` build
# metadata bookstack-chart uses: Helm rewrites `+` to `_` on OCI push (and
# back on pull), which breaks listing in some third-party tooling (e.g.
# Rancher). The aptly version lives in appVersion instead. A SemVer
# pre-release suffix (`chart/v0.2.0-rc.1`) works fine and is unaffected.
#
# The chart is pushed under f.weber/charts/aptly, NOT f.weber/aptly: Gitea's
# package registry stores both container images and Helm OCI charts as
# generic OCI artifacts, and a chart sharing the exact repository path with
# the container image of the same name makes the package listing/type
# ambiguous. A distinct `charts/` path keeps the two package kinds apart.
on:
  release:
    types: [published]

concurrency:
  group: release-chart
  cancel-in-progress: false

jobs:
  release:
    if: startsWith(gitea.event.release.tag_name, 'chart/v')
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Parse chart version from the release's tag
        id: version
        run: echo "version=${TAG_NAME#chart/v}" >> "$GITEA_OUTPUT"
        env:
          TAG_NAME: ${{ gitea.event.release.tag_name }}

      - uses: azure/setup-helm@v4.3.0
        with:
          version: ${{ vars.HELM_VERSION || '3.16.4' }}

      - name: Quality gate
        run: |
          set -e
          helm lint charts/aptly
          for f in charts/aptly/ci/*.yaml; do
            helm template test charts/aptly -f "$f" > /dev/null
          done

      - name: Idempotency check — refuse to overwrite an existing chart version
        run: |
          if helm show chart "oci://git.morlana.online/f.weber/charts/aptly" --version "${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
            echo "::error::chart version ${{ steps.version.outputs.version }} already exists in the registry. Bump the version and re-tag — this workflow never overwrites a published chart."
            exit 1
          fi

      - name: Set ArtifactHub prerelease annotation (packaged copy only, never committed)
        if: gitea.event.release.prerelease
        run: |
          yq -i '.annotations["artifacthub.io/prerelease"] = "true"' charts/aptly/Chart.yaml

      - name: Import GPG signing key
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
          trust_level: 5

      - name: Build legacy secret keyring (helm package --sign wants gpg1-style secring.gpg)
        run: |
          mkdir -p /tmp/gpgring
          gpg --batch --pinentry-mode loopback --passphrase "${{ secrets.GPG_PASSPHRASE }}" \
            --export-secret-keys > /tmp/gpgring/secring.gpg
          printf '%s' "${{ secrets.GPG_PASSPHRASE }}" > /tmp/gpgring/passphrase.txt
          chmod 600 /tmp/gpgring/*

      # secrets.GPG_KEY_ID/GPG_PRIVATE_KEY must be an RSA (or other classic,
      # non-EdDSA) key — Helm's sign/verify uses the deprecated
      # golang.org/x/crypto/openpgp library, which cannot read Ed25519 keys at
      # all (fails with "private key not found"). See pubkeys/README.md.
      - name: Package & sign
        run: |
          helm package charts/aptly \
            --version "${{ steps.version.outputs.version }}" \
            --dependency-update \
            --sign --key "${{ secrets.GPG_KEY_ID }}" \
            --keyring /tmp/gpgring/secring.gpg \
            --passphrase-file /tmp/gpgring/passphrase.txt

      - name: helm registry login & push
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | helm registry login git.morlana.online \
            --username "${{ secrets.REGISTRY_USER }}" --password-stdin
          helm push "aptly-${{ steps.version.outputs.version }}.tgz" oci://git.morlana.online/f.weber/charts

      - name: Attach chart artifacts to the Gitea release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ gitea.event.release.tag_name }}
          name: "aptly chart ${{ steps.version.outputs.version }}"
          prerelease: ${{ gitea.event.release.prerelease }}
          body: |
            `helm pull oci://git.morlana.online/f.weber/charts/aptly --version ${{ steps.version.outputs.version }}`
          files: |
            aptly-${{ steps.version.outputs.version }}.tgz
            aptly-${{ steps.version.outputs.version }}.tgz.prov
            pubkeys/chart-signing.asc

      - name: Clean up key material
        if: always()
        run: rm -rf /tmp/gpgring