Add Helm CI (#6)

.github/actions/helm-login/action.yml

@@ -0,0 +1,37 @@
+name: Helm Login
+
+description: Log Helm in to an OCI repo
+
+inputs:
+  registry:
+    required: false
+    description: |
+      OCI registry; usually host, or host:port pair, also specifies the prefix
+      of the push URL.
+
+  username:
+    required: true
+    description: OCI registry username.
+
+  password:
+    required: true
+    description: OCI registry password.
+
+runs:
+  using: composite
+  steps:
+
+    - name: Login Helm into the registry
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        helm registry login \
+          -u "$USERNAME" \
+          --password-stdin \
+          "$REGISTRY" <<<"$PASSWORD"
+
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        USERNAME: ${{ inputs.username }}
+        PASSWORD: ${{ inputs.password }}

.github/actions/helm-meta/action.yml

@@ -0,0 +1,35 @@
+name: Helm Metadata
+
+description: Prepare Helm packaging metadata
+
+outputs:
+
+  short-sha:
+    description: The short for of the current commit's SHA hashsum
+    value: ${{ steps.meta.outputs.short-sha }}
+
+  chart-app-version:
+    description: The chart app version to use
+    value: ${{ steps.meta.outputs.chart-app-version}}
+
+  chart-version:
+    description: The chart version to use
+    value: ${{ steps.meta.outputs.chart-version}}
+
+runs:
+  using: composite
+  steps:
+
+    - name: Prepare metadata
+      id: meta
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        SHORT_SHA="$(git rev-parse --short HEAD)"
+        CHART_APP_VERSION="sha-${SHORT_SHA}"
+        CHART_VERSION="0.0.0-${CHART_APP_VERSION}"
+
+        printf 'short-sha=%s\n' "$SHORT_SHA" >>"$GITHUB_OUTPUT"
+        printf 'chart-app-version=%s\n' "$CHART_APP_VERSION" >>"$GITHUB_OUTPUT"
+        printf 'chart-version=%s\n' "$CHART_VERSION" >>"$GITHUB_OUTPUT"

.github/actions/helm-publish/action.yml

@@ -0,0 +1,73 @@
+name: Helm Publish
+
+description: Publish Helm chart to an OCI repo
+
+inputs:
+  chart-name:
+    required: true
+    description: The name of the chart to publish.
+
+  chart-path:
+    required: true
+    description: The path to the chart to publish.
+
+  chart-version:
+    required: true
+    description: The chart version to use.
+
+  chart-app-version:
+    required: true
+    description: The chart app version to use.
+
+  registry:
+    required: false
+    description: |
+      OCI registry; usually host, or host:port pair, also specifies the prefix
+      if the push URL.
+
+  registry-path:
+    required: false
+    description: |
+      The path to place the chart under the OCI registry's root (host);
+      make sure this path doesn't end with the chart name, as helm will add it
+      automatically.
+
+runs:
+  using: composite
+  steps:
+
+    - name: Package chart
+      id: packaging
+      shell: bash
+      run: |
+        set -euo pipefail
+        set -x
+
+        DESTINATION_DIR="${RUNNER_TEMP}/${RANDOM}${RANDOM}"
+        rm -rf "$DESTINATION_DIR"
+
+        helm package "$CHART_PATH" \
+          --app-version "$CHART_APP_VERSION" \
+          --version "$CHART_VERSION" \
+          --destination "$DESTINATION_DIR"
+
+        PACKAGE_PATH="$(find "$DESTINATION_DIR" -mindepth 1 -maxdepth 1 -name '*.tgz' -print -quit)"
+
+        printf 'destination-dir=%s\n' "$DESTINATION_DIR" >>"$GITHUB_OUTPUT"
+        printf 'package-path=%s\n' "$PACKAGE_PATH" >>"$GITHUB_OUTPUT"
+
+      env:
+        CHART_PATH: ${{ inputs.chart-path }}
+        CHART_VERSION: ${{ inputs.chart-version }}
+        CHART_APP_VERSION: ${{ inputs.chart-app-version }}
+
+    - name: Push chart
+      id: push
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        helm push "$PACKAGE_PATH" "${REMOTE,,}" | tee -a "$GITHUB_STEP_SUMMARY"
+      env:
+        PACKAGE_PATH: ${{ steps.packaging.outputs.package-path }}
+        REMOTE: oci://${{ inputs.registry }}/${{ inputs.registry-path }}

.github/workflows/helm.yml

@@ -0,0 +1,52 @@
+name: helm
+
+on:
+  push:
+    branches:
+      - "**"
+      - "!gh-readonly-queue/**"
+    tags:
+      - "v*.*.*"
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.event_name != 'merge_group' }}
+
+jobs:
+  helm:
+    name: Helm
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        timeout-minutes: 5
+
+      - name: Helm meta
+        uses: ./.github/actions/helm-meta
+        id: meta
+        timeout-minutes: 5
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: ./.github/actions/helm-login
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+        timeout-minutes: 5
+
+      - name: Publish port-forward-controller
+        uses: ./.github/actions/helm-publish
+        with:
+          chart-name: port-forward-controller
+          chart-path: charts/port-forward-controller
+          chart-version: ${{ steps.meta.outputs.chart-version }}
+          chart-app-version: ${{ steps.meta.outputs.chart-app-version }}
+          registry: ghcr.io
+          registry-path: ${{ github.repository }}/charts
+        timeout-minutes: 5