name: Release management

on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write

env:
  CHART: blueprints/helm/devops-platform
  OCI_REGISTRY: ghcr.io/${{ github.repository_owner }}/charts

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: azure/setup-helm@v4
      - run: helm lint "$CHART"
      - run: helm package "$CHART" --destination dist --app-version "${GITHUB_REF_NAME#v}" --version "${GITHUB_REF_NAME#v}"
      - name: Login to OCI registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
      - name: Publish Helm chart
        run: helm push dist/*.tgz "oci://${OCI_REGISTRY}"
      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: dist/*.tgz
      - uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: dist/*.tgz