build-canary-chart.yaml

name: Build Canary Chart

on:
  pull_request:
    # Only consider PRs that change files for this asset, including ci scripts
    paths:
      - '.github/workflows/build-canary-chart.yaml'
      - 'charts/canary/**'
    # Make sure all workflows that are "required checks" for a given
    # branch protection rule have the same paths: and branches-ignore:
    # filters. Otherwise, you can end up in a deadlock waiting on a
    # required check that will never be executed.
  push:
    # Only release off of release and maintenance branches for this asset
    branches:
      - 'main'
    # Only consider pushes that change files for this asset, including ci scripts
    paths:
      - '.github/workflows/build-canary-chart.yaml'
      - 'charts/canary/**'

permissions:
  contents: write
  pull-requests: write
  actions: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  # Cancel early on pull requests if new commits are added,
  # Don't cancel on release pushes
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  # Job name must be unique across repo to target
  # branch protection rules "required checks" properly!
  canary-chart:
    uses: SwanseaUniversityMedical/workflows/.github/workflows/pr-and-release-chart.yaml@v2.0.3-charts
    with:
      job-name: canary-chart
      comment-pr: "true"
      comment-release: "true"
      registry: ${{ vars.HARBOR_REGISTRY }}
      registry-user: ${{ vars.HARBOR_USER }}
      registry-project: ${{ vars.HARBOR_PROJECT }}
      registry-repo: canary
      release-tag-format: 'canary-chart-${version}'
      cosign-public-key: ${{ vars.COSIGN_PUBLIC_KEY }}
      chart: charts/canary
      test-command: |
        helm template $CHART \
          --include-crds \
          --name-template canary \
          --namespace canary \
          --create-namespace \
          --debug

    secrets:
      cosign-private-key: ${{ secrets.COSIGN_PRIVATE_KEY }}
      cosign-password: ${{ secrets.COSIGN_PASSWORD }}
      registry-token: ${{ secrets.HARBOR_TOKEN }}