tag-publish 1.2.0.dev101__tar.gz → 1.2.0.dev105__tar.gz

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tag-publish
-Version: 1.2.0.dev101
+Version: 1.2.0.dev105
 Summary: Tools used to publish Python packages, Docker images and Helm charts for GitHub tag and branch
 License: FreeBSD
 License-File: LICENSE
@@ -51,11 +51,11 @@ Set the permissions:
 
 ```yaml
 permissions:
-  # To publish Docker images on GHCR and on npm.pkg.github.com
+  # To publish Docker images on GHCR, npm packages and Helm charts on OCI registry
   packages: write
-  # To publish Python packages using OIDC
+  # To publish Python packages using OIDC and for cosign keyless signing
   id-token: write
-  # To publish Helm charts and send repository dispatch notifications
+  # To publish Helm charts (chart-releaser) and send repository dispatch notifications
   contents: write
 ```
 
@@ -316,6 +316,36 @@ git commit --allow-empty -m "Initialize gh-pages branch"
 git push origin gh-pages
 ```
 
+#### OCI registry publishing
+
+By default, the Helm chart is also published to an OCI registry (`ghcr.io/<owner>/<repo>`) and signed with [cosign](https://github.com/sigstore/cosign) using keyless signing.
+
+The chart is pushed to `ghcr.io/<owner>/<repo>:<version>` automatically.
+
+The required permissions are `packages: write` (for pushing to ghcr.io) and `id-token: write` (for cosign keyless signing).
+
+To customize the OCI publishing:
+
+```yaml
+helm:
+  packages:
+    - folder: charts/my-chart
+  oci:
+    enabled: true # default: true
+    registry: ghcr.io # default: ghcr.io
+    sign: true # default: true, keyless signing via cosign
+```
+
+To disable OCI publishing:
+
+```yaml
+helm:
+  packages:
+    - {}
+  oci:
+    enabled: false
+```
+
 ## Dispatch
 
 The minimal config is like this:

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/README.md

@@ -15,11 +15,11 @@ Set the permissions:
 
 ```yaml
 permissions:
-  # To publish Docker images on GHCR and on npm.pkg.github.com
+  # To publish Docker images on GHCR, npm packages and Helm charts on OCI registry
   packages: write
-  # To publish Python packages using OIDC
+  # To publish Python packages using OIDC and for cosign keyless signing
   id-token: write
-  # To publish Helm charts and send repository dispatch notifications
+  # To publish Helm charts (chart-releaser) and send repository dispatch notifications
   contents: write
 ```
 
@@ -280,6 +280,36 @@ git commit --allow-empty -m "Initialize gh-pages branch"
 git push origin gh-pages
 ```
 
+#### OCI registry publishing
+
+By default, the Helm chart is also published to an OCI registry (`ghcr.io/<owner>/<repo>`) and signed with [cosign](https://github.com/sigstore/cosign) using keyless signing.
+
+The chart is pushed to `ghcr.io/<owner>/<repo>:<version>` automatically.
+
+The required permissions are `packages: write` (for pushing to ghcr.io) and `id-token: write` (for cosign keyless signing).
+
+To customize the OCI publishing:
+
+```yaml
+helm:
+  packages:
+    - folder: charts/my-chart
+  oci:
+    enabled: true # default: true
+    registry: ghcr.io # default: ghcr.io
+    sign: true # default: true, keyless signing via cosign
+```
+
+To disable OCI publishing:
+
+```yaml
+helm:
+  packages:
+    - {}
+  oci:
+    enabled: false
+```
+
 ## Dispatch
 
 The minimal config is like this:

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/pyproject.toml

@@ -35,7 +35,7 @@ include = [
 ]
 requires-python = ">=3.10"
 dependencies = ["requests<3,>=2", "twine<7,>=6", "PyYAML<7,>=6", "id<2,>=1", "security-md<2,>=1", "applications-download<2,>=1", "jsonschema-validator-new<1,>=0", "debian-inspector<32,>=31", "multi-repo-automation<2,>=1", "githubkit<1,>=0"]
-version = "1.2.0.dev101"
+version = "1.2.0.dev105"
 
 [project.urls]
 repository = "https://github.com/camptocamp/tag-publish"

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/tag_publish/cli.py

@@ -470,7 +470,16 @@ def _handle_helm_publish(
                         print(f"Publishing '{folder}' to helm, skipping (dry run)")
                     else:
                         token = os.environ["GITHUB_TOKEN"]
-                        success &= tag_publish.publish.helm(folder, version, owner, repo, commit_sha, token)
+                        oci_config = helm_config.get("oci")
+                        success &= tag_publish.publish.helm(
+                            folder,
+                            version,
+                            owner,
+                            repo,
+                            commit_sha,
+                            token,
+                            oci_config,
+                        )
                         published_payload.append({"type": "helm", "folder": folder})
                 else:
                     print(

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/tag_publish/configuration.py

@@ -49,7 +49,7 @@ class Configuration(TypedDict, total=False):
     r"""
     helm.
 
-    Configuration to publish Helm charts on GitHub release
+    Configuration to publish Helm charts on GitHub release and OCI registry
     """
 
     dispatch: list["DispatchConfig"]
@@ -238,6 +238,21 @@ class DockerRepository(TypedDict, total=False):
 
 
 
+HELM_OCI_ENABLED_DEFAULT = True
+r""" Default value of the field path 'helm OCI enabled' """
+
+
+
+HELM_OCI_REGISTRY_DEFAULT = 'ghcr.io'
+r""" Default value of the field path 'helm OCI registry' """
+
+
+
+HELM_OCI_SIGN_DEFAULT = True
+r""" Default value of the field path 'helm OCI sign' """
+
+
+
 HELM_PACKAGE_FOLDER_DEFAULT = '.'
 r""" Default value of the field path 'helm package folder' """
 
@@ -257,7 +272,7 @@ class Helm(TypedDict, total=False):
     r"""
     helm.
 
-    Configuration to publish Helm charts on GitHub release
+    Configuration to publish Helm charts on GitHub release and OCI registry
     """
 
     packages: list["HelmPackage"]
@@ -273,6 +288,49 @@ class Helm(TypedDict, total=False):
       - tag
     """
 
+    oci: "HelmOci"
+    r"""
+    helm OCI.
+
+    The configuration for Helm chart publishing on OCI registry
+    """
+
+
+
+class HelmOci(TypedDict, total=False):
+    r"""
+    helm OCI.
+
+    The configuration for Helm chart publishing on OCI registry
+    """
+
+    enabled: bool
+    r"""
+    helm OCI enabled.
+
+    Enable publishing to an OCI registry
+
+    default: True
+    """
+
+    registry: str
+    r"""
+    helm OCI registry.
+
+    The OCI registry host
+
+    default: ghcr.io
+    """
+
+    sign: bool
+    r"""
+    helm OCI sign.
+
+    Enable keyless signing of the chart using cosign
+
+    default: True
+    """
+
 
 
 class HelmPackage(TypedDict, total=False):

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/tag_publish/publish.py

@@ -11,6 +11,7 @@ from pathlib import Path
 import ruamel
 import tomllib
 
+import tag_publish
 import tag_publish.configuration
 
 
@@ -263,7 +264,15 @@ def docker(
     return True
 
 
-def helm(folder: str, version: str, owner: str, repo: str, commit_sha: str, token: str) -> bool:
+def helm(
+    folder: str,
+    version: str,
+    owner: str,
+    repo: str,
+    commit_sha: str,
+    token: str,
+    oci_config: tag_publish.configuration.HelmOci | None = None,
+) -> bool:
     """
     Publish to pypi.
 
@@ -274,17 +283,20 @@ def helm(folder: str, version: str, owner: str, repo: str, commit_sha: str, toke
         repo: The GitHub repository name
         commit_sha: The sha of the current commit
         token: The GitHub token
+        oci_config: The OCI registry configuration
 
     """
     print(f"::group::Publishing Helm chart from '{folder}' to GitHub release")
     sys.stdout.flush()
     sys.stderr.flush()
 
+    chart_name = ""
     try:
         yaml_ = ruamel.yaml.YAML()
         with (Path(folder) / "Chart.yaml").open(encoding="utf-8") as open_file:
             chart = yaml_.load(open_file)
         chart["version"] = version
+        chart_name = chart.get("name", "")
         with (Path(folder) / "Chart.yaml").open("w", encoding="utf-8") as open_file:
             yaml_.dump(chart, open_file)
         for index, dependency in enumerate(chart.get("dependencies", [])):
@@ -327,6 +339,39 @@ def helm(folder: str, version: str, owner: str, repo: str, commit_sha: str, toke
             check=True,
         )
         print("::endgroup::")
+
+        oci_config = oci_config or {}
+        if oci_config.get("enabled", tag_publish.configuration.HELM_OCI_ENABLED_DEFAULT):
+            registry = oci_config.get("registry", tag_publish.configuration.HELM_OCI_REGISTRY_DEFAULT)
+            oci_repository = f"{registry}/{owner}/{repo}"
+            print(f"::group::Publishing Helm chart '{folder}' to OCI registry {oci_repository}")
+
+            subprocess.run(
+                ["helm", "registry", "login", registry, f"--username={owner}", f"--password={token}"],
+                check=True,
+            )
+
+            chart_archive = f"{chart_name}-{version}.tgz"
+            if not Path(chart_archive).exists():
+                print(f"Error: chart archive {chart_archive} not found")
+                print("::endgroup::")
+                print("::error::Chart archive not found")
+                return False
+            subprocess.run(
+                ["helm", "push", chart_archive, f"oci://{oci_repository}"],
+                check=True,
+            )
+
+            if oci_config.get("sign", tag_publish.configuration.HELM_OCI_SIGN_DEFAULT):
+                print(f"Signing chart with cosign at oci://{oci_repository}:{version}")
+                tag_publish.download_application("sigstore/cosign")
+                subprocess.run(
+                    ["cosign", "sign", f"oci://{oci_repository}:{version}", "--yes"],
+                    check=True,
+                )
+
+            print("::endgroup::")
+
     except subprocess.CalledProcessError as exception:
         print(f"Error: {exception}")
         print("::endgroup::")

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/tag_publish/schema.json

@@ -215,7 +215,7 @@
     },
     "helm": {
       "title": "helm",
-      "description": "Configuration to publish Helm charts on GitHub release",
+      "description": "Configuration to publish Helm charts on GitHub release and OCI registry",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -251,6 +251,32 @@
           "items": {
             "type": "string"
           }
+        },
+        "oci": {
+          "title": "helm OCI",
+          "description": "The configuration for Helm chart publishing on OCI registry",
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "description": "Enable publishing to an OCI registry",
+              "title": "helm OCI enabled",
+              "default": true,
+              "type": "boolean"
+            },
+            "registry": {
+              "description": "The OCI registry host",
+              "title": "helm OCI registry",
+              "default": "ghcr.io",
+              "type": "string"
+            },
+            "sign": {
+              "description": "Enable keyless signing of the chart using cosign",
+              "title": "helm OCI sign",
+              "default": true,
+              "type": "boolean"
+            }
+          }
         }
       }
     },

{tag_publish-1.2.0.dev101 → tag_publish-1.2.0.dev105}/tag_publish/versions.yaml

@@ -1,2 +1,3 @@
 # https://docs.renovatebot.com/modules/datasource/#github-releases-datasource
 helm/chart-releaser: v1.8.1 # github-releases
+sigstore/cosign: v3.1.1 # github-releases