name: "Release helm"

on:
  push:
    tags:
      - "helm/v*"

permissions:
  contents: "read"

jobs:
  publish-helm:
    name: "publish-helm"
    runs-on: "runs-on=${{ github.run_id }}/runner=2cpu-linux-x64/extras=s3-cache"
    permissions:
      contents: "read"
    steps:
      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v6
      - uses: "runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60" # v2
      - uses: "azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310" # v5.0.1
        with:
          version: "3.17.3"
      - name: "Validate chart version"
        run: |
          VERSION="${GITHUB_REF_NAME##*/v}"
          CHART_VERSION="$(awk '/^version:/ { print $2 }' contrib/helm/charts/probo/Chart.yaml)"
          if [ "${CHART_VERSION}" != "${VERSION}" ]; then
            echo "Chart.yaml version (${CHART_VERSION}) does not match tag (${VERSION})"
            exit 1
          fi
      - name: "Log in to Harbor"
        uses: "docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee" # v4.2.0
        with:
          registry: artifact.probo.inc
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}
      - name: "Package and push Helm chart"
        run: |
          VERSION="${GITHUB_REF_NAME##*/v}"
          CHART_DIR="contrib/helm/charts/probo"

          helm dependency update "${CHART_DIR}"
          helm package "${CHART_DIR}"
          helm push "probo-${VERSION}.tgz" oci://artifact.probo.inc/probo
      - uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7
        with:
          name: "helm-chart"
          path: "probo-*.tgz"
          retention-days: 1

  github-release:
    name: "github-release"
    needs: [publish-helm]
    runs-on: "runs-on=${{ github.run_id }}/runner=2cpu-linux-x64/extras=s3-cache"
    permissions:
      contents: "write"
    steps:
      - uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v6
        with:
          fetch-depth: 0
      - uses: "runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60" # v2
      - uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8
        with:
          name: "helm-chart"
          path: "."
      - name: "Extract release notes"
        run: |
          VERSION="${GITHUB_REF_NAME##*/v}"
          APP_VERSION="$(awk '/^appVersion:/ { gsub(/"/, "", $2); print $2 }' contrib/helm/charts/probo/Chart.yaml)"
          awk -v ver="$VERSION" '
            /^## \[/ { if (found) exit; if ($0 ~ "\\[" ver "\\]") found=1 }
            found
          ' contrib/helm/charts/probo/CHANGELOG.md > release-notes.md
          cat >> release-notes.md << EOF

          ## Install

          \`\`\`bash
          helm install my-probo oci://artifact.probo.inc/probo/probo --version ${VERSION}
          \`\`\`

          Defaults to probod image tag \`v${APP_VERSION}\`.
          EOF
      - name: "Create GitHub release"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PRERELEASE_FLAG=""
          if echo "${GITHUB_REF_NAME}" | grep -qE '(alpha|beta|rc)'; then
            PRERELEASE_FLAG="--prerelease"
          fi

          gh release delete "${GITHUB_REF_NAME}" --yes 2>/dev/null || true

          gh release create "${GITHUB_REF_NAME}" \
            --title "${GITHUB_REF_NAME}" \
            --notes-file release-notes.md \
            $PRERELEASE_FLAG \
            probo-*.tgz