artifacts.yaml

name: Artifacts

on:
  workflow_call:
    inputs:
      publish:
        description: Publish artifacts to the artifact store
        default: false
        required: false
        type: boolean
      release:
        description: Whether this is a release build
        default: false
        required: false
        type: boolean
    outputs:
      helm-chart-name:
        description: Helm chart OCI name
        value: ${{ jobs.helm-chart.outputs.name }}
      helm-chart-tag:
        description: Helm chart tag
        value: ${{ jobs.helm-chart.outputs.tag }}
      helm-chart-package:
        description: Helm chart package name
        value: ${{ jobs.helm-chart.outputs.package }}

permissions:
  contents: read

jobs:
  helm-chart:
    name: Helm chart
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      id-token: write
      security-events: write

    outputs:
      name: ${{ steps.oci-chart-name.outputs.value }}
      tag: ${{ steps.version.outputs.value }}
      package: ${{ steps.build.outputs.package }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Helm
        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
        with:
          version: v3.12.0

      - name: Set up Cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Set chart name
        id: chart-name
        run: echo "value=vault" >> "$GITHUB_OUTPUT"

      - name: Set OCI registry name
        id: oci-registry-name
        run: echo "value=ghcr.io/${{ github.repository_owner }}/helm-charts" >> "$GITHUB_OUTPUT"

      - name: Set OCI chart name
        id: oci-chart-name
        run: echo "value=${{ steps.oci-registry-name.outputs.value }}/${{ steps.chart-name.outputs.value }}" >> "$GITHUB_OUTPUT"

      - name: Helm lint
        run: helm lint ${{ steps.chart-name.outputs.value }}

      - name: Determine raw version
        uses: haya14busa/action-cond@94f77f7a80cd666cb3155084e428254fea4281fd # v1.2.1
        id: raw-version
        with:
          cond: ${{ inputs.release }}
          if_true: ${{ github.ref_name }}
          if_false: v0.0.0

      - name: Determine version
        id: version
        run: |
          VERSION=${{ steps.raw-version.outputs.value }}
          echo "value=${VERSION#v}" >> "$GITHUB_OUTPUT"

      - name: Helm package
        id: build
        run: |
          helm package ${{ steps.chart-name.outputs.value }} --version ${{ steps.version.outputs.value }}
          echo "package=${{ steps.chart-name.outputs.value }}-${{ steps.version.outputs.value }}.tgz" >> "$GITHUB_OUTPUT"

      - name: Upload chart as artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: "[${{ github.job }}] Helm chart"
          path: ${{ steps.build.outputs.package }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
        if: inputs.publish && inputs.release

      - name: Helm push
        id: push
        run: |
          helm push ${{ steps.build.outputs.package }} oci://${{ steps.oci-registry-name.outputs.value }} &> push-metadata.txt
          echo "digest=$(awk '/Digest: /{print $2}' push-metadata.txt)" >> "$GITHUB_OUTPUT"
        env:
          HELM_REGISTRY_CONFIG: ~/.docker/config.json
        if: inputs.publish && inputs.release

      - name: Sign chart with GitHub OIDC Token
        if: ${{ inputs.publish && inputs.release && github.repository_owner == 'bank-vaults' }} # Check if the workflow is called by the same GitHub organization
        env:
          DIGEST: ${{ steps.push.outputs.digest }}
        run: cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" "${{ steps.oci-chart-name.outputs.value }}@${DIGEST}"

      - name: Verify signed chart with cosign
        if: ${{ inputs.publish && inputs.release && github.repository_owner == 'bank-vaults' }} # Check if the workflow is called by the same GitHub organization
        env:
          DIGEST: ${{ steps.push.outputs.digest }}
        run: |
          cosign verify "${{ steps.oci-chart-name.outputs.value }}@${DIGEST}" \
            --rekor-url "https://rekor.sigstore.dev/" \
            --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/artifacts.yaml@${{ github.ref }}" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq

      - name: Upload package as artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: "[${{ github.job }}] package"
          path: ${{ steps.build.outputs.package }}

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
        with:
          scan-type: config
          scan-ref: ${{ steps.chart-name.outputs.value }}
          format: sarif
          output: trivy-results.sarif

      - name: Upload Trivy scan results as artifact
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: "[${{ github.job }}] Trivy scan results"
          path: trivy-results.sarif
          retention-days: 5

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
        with:
          sarif_file: trivy-results.sarif