Skip to content

Commit 082ba3d

Browse files
ci: added helm cosign verification and renovate app workflow to bump chart versions (#2064)
* ci: added helm cosign verification and renovate app workflow to bump chart versions * docs: add helm artifacts verification Signed-off-by: Ludovic Ortega <[email protected]> * fix: update app id Signed-off-by: Ludovic Ortega <[email protected]> * docs: add documentation link in helm chart and seerr docs Signed-off-by: Ludovic Ortega <[email protected]> --------- Signed-off-by: Ludovic Ortega <[email protected]> Co-authored-by: Ludovic Ortega <[email protected]>
1 parent a975ab2 commit 082ba3d

File tree

8 files changed

+376
-34
lines changed

8 files changed

+376
-34
lines changed

.github/workflows/helm.yml

Lines changed: 49 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ jobs:
5555
# get current version
5656
current_version=$(grep '^version:' "$chart_path/Chart.yaml" | awk '{print $2}')
5757
# try to get current release version
58-
if oras manifest fetch "ghcr.io/${GITHUB_REPOSITORY@L}/${chart_name}:${current_version}" >/dev/null 2>&1; then
58+
if oras manifest fetch "ghcr.io/${{ github.repository }}/${chart_name}:${current_version}" >/dev/null 2>&1; then
5959
echo "No version change for $chart_name. Skipping."
6060
else
6161
helm dependency build "$chart_path"
@@ -87,8 +87,8 @@ jobs:
8787
name: Publish to ghcr.io
8888
runs-on: ubuntu-24.04
8989
permissions:
90-
packages: write # needed for pushing to github registry
91-
id-token: write # needed for signing the images with GitHub OIDC Token
90+
packages: write
91+
id-token: write
9292
needs: [package-helm-chart]
9393
if: needs.package-helm-chart.outputs.has_artifacts == 'true'
9494
steps:
@@ -128,17 +128,59 @@ jobs:
128128
# push chart to OCI
129129
chart_release_file=$(basename "$chart_path")
130130
chart_name=${chart_release_file%-*}
131-
helm push ${chart_path} oci://ghcr.io/${GITHUB_REPOSITORY@L} |& tee helm-push-output.log
131+
helm push ${chart_path} oci://ghcr.io/${{ github.repository }} |& tee helm-push-output.log
132132
chart_digest=$(awk -F "[, ]+" '/Digest/{print $NF}' < helm-push-output.log)
133133
# sign chart
134-
cosign sign "ghcr.io/${GITHUB_REPOSITORY@L}/${chart_name}@${chart_digest}"
134+
cosign sign "ghcr.io/${{ github.repository }}/${chart_name}@${chart_digest}"
135135
# push artifacthub-repo.yml to OCI
136136
oras push \
137-
ghcr.io/${GITHUB_REPOSITORY@L}/${chart_name}:artifacthub.io \
137+
ghcr.io/${{ github.repository }}/${chart_name}:artifacthub.io \
138138
--config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
139139
charts/$chart_name/artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml \
140140
|& tee oras-push-output.log
141141
artifacthub_digest=$(grep "Digest:" oras-push-output.log | awk '{print $2}')
142142
# sign artifacthub-repo.yml
143-
cosign sign "ghcr.io/${GITHUB_REPOSITORY@L}/${chart_name}:artifacthub.io@${artifacthub_digest}"
143+
cosign sign "ghcr.io/${{ github.repository }}/${chart_name}:artifacthub.io@${artifacthub_digest}"
144+
done
145+
146+
verify:
147+
name: Verify signatures for each chart tag
148+
needs: [publish]
149+
runs-on: ubuntu-24.04
150+
permissions:
151+
contents: read
152+
steps:
153+
- name: Checkout
154+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
155+
with:
156+
fetch-depth: 0
157+
persist-credentials: false
158+
159+
- name: Install Cosign
160+
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
161+
162+
- name: Downloads artifacts
163+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
164+
with:
165+
name: artifacts
166+
path: .cr-release-packages/
167+
168+
- name: Login to GitHub Container Registry
169+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
170+
with:
171+
registry: ghcr.io
172+
username: ${{ github.actor }}
173+
password: ${{ secrets.GITHUB_TOKEN }}
174+
175+
- name: Verify signatures for each chart tag
176+
run: |
177+
for chart_path in $(find .cr-release-packages -name '*.tgz' -print); do
178+
chart_release_file=$(basename "$chart_path")
179+
chart_name=${chart_release_file%-*}
180+
version=${chart_release_file#$chart_name-}
181+
version=${version%.tgz}
182+
183+
cosign verify "ghcr.io/${{ github.repository }}/${chart_name}:${version}" \
184+
--certificate-identity "https://github.com/${{ github.workflow_ref }}" \
185+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
144186
done

.github/workflows/release.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
23
name: Seerr Release
34

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
3+
name: Renovate Helm Hooks
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- develop
9+
paths:
10+
- 'charts/**'
11+
12+
permissions: {}
13+
14+
concurrency:
15+
group: renovate-helm-hooks-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
jobs:
19+
renovate-post-run:
20+
name: Renovate Bump Chart Version
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
pull-requests: write
25+
if: github.actor == 'renovate[bot]'
26+
steps:
27+
- name: Checkout code
28+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
29+
with:
30+
fetch-depth: 0
31+
persist-credentials: false
32+
33+
- uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
34+
id: app-token
35+
with:
36+
app-id: 2138788
37+
private-key: ${{ secrets.APP_SEERR_HELM_PRIVATE_KEY }}
38+
39+
- name: Set up chart-testing
40+
uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
41+
42+
- name: Run chart-testing (list-changed)
43+
id: list-changed
44+
run: |
45+
changed="$(ct list-changed --target-branch ${TARGET_BRANCH})"
46+
if [[ -n "$changed" ]]; then
47+
echo "changed=true" >> "$GITHUB_OUTPUT"
48+
echo "changed_list=${changed//$'\n'/ }" >> "$GITHUB_OUTPUT"
49+
fi
50+
env:
51+
TARGET_BRANCH: ${{ github.event.repository.default_branch }}
52+
53+
- name: Bump chart version
54+
if: steps.list-changed.outputs.changed == 'true'
55+
env:
56+
CHART: ${{ steps.list-changed.outputs.changed_list }}
57+
run: |
58+
if [[ ! -d "${CHART}" ]]; then
59+
echo "${CHART} directory not found"
60+
exit 0
61+
fi
62+
63+
# Extract current appVersion and chart version from Chart.yaml
64+
APP_VERSION=$(grep -e "^appVersion:" "$CHART/Chart.yaml" | cut -d ":" -f 2 | tr -d '[:space:]' | tr -d '"')
65+
CHART_VERSION=$(grep -e "^version:" "$CHART/Chart.yaml" | cut -d ":" -f 2 | tr -d '[:space:]' | tr -d '"')
66+
67+
# Extract major, minor and patch versions of appVersion
68+
APP_MAJOR_VERSION=$(printf '%s' "$APP_VERSION" | cut -d "." -f 1)
69+
APP_MINOR_VERSION=$(printf '%s' "$APP_VERSION" | cut -d "." -f 2)
70+
APP_PATCH_VERSION=$(printf '%s' "$APP_VERSION" | cut -d "." -f 3)
71+
72+
# Extract major, minor and patch versions of chart version
73+
CHART_MAJOR_VERSION=$(printf '%s' "$CHART_VERSION" | cut -d "." -f 1)
74+
CHART_MINOR_VERSION=$(printf '%s' "$CHART_VERSION" | cut -d "." -f 2)
75+
CHART_PATCH_VERSION=$(printf '%s' "$CHART_VERSION" | cut -d "." -f 3)
76+
77+
# Get previous appVersion from the base commit of the pull request
78+
BASE_COMMIT=$(git merge-base origin/main HEAD)
79+
PREV_APP_VERSION=$(git show "$BASE_COMMIT":"$CHART/Chart.yaml" | grep -e "^appVersion:" | cut -d ":" -f 2 | tr -d '[:space:]' | tr -d '"')
80+
81+
# Extract major, minor and patch versions of previous appVersion
82+
PREV_APP_MAJOR_VERSION=$(printf '%s' "$PREV_APP_VERSION" | cut -d "." -f 1)
83+
PREV_APP_MINOR_VERSION=$(printf '%s' "$PREV_APP_VERSION" | cut -d "." -f 2)
84+
PREV_APP_PATCH_VERSION=$(printf '%s' "$PREV_APP_VERSION" | cut -d "." -f 3)
85+
86+
# Check if the major, minor, or patch version of appVersion has changed
87+
if [[ "$APP_MAJOR_VERSION" != "$PREV_APP_MAJOR_VERSION" ]]; then
88+
# Bump major version of the chart and reset minor and patch versions to 0
89+
CHART_MAJOR_VERSION=$((CHART_MAJOR_VERSION+1))
90+
CHART_MINOR_VERSION=0
91+
CHART_PATCH_VERSION=0
92+
elif [[ "$APP_MINOR_VERSION" != "$PREV_APP_MINOR_VERSION" ]]; then
93+
# Bump minor version of the chart and reset patch version to 0
94+
CHART_MINOR_VERSION=$((CHART_MINOR_VERSION+1))
95+
CHART_PATCH_VERSION=0
96+
elif [[ "$APP_PATCH_VERSION" != "$PREV_APP_PATCH_VERSION" ]]; then
97+
# Bump patch version of the chart
98+
CHART_PATCH_VERSION=$((CHART_PATCH_VERSION+1))
99+
fi
100+
101+
# Update the chart version in Chart.yaml
102+
CHART_NEW_VERSION="${CHART_MAJOR_VERSION}.${CHART_MINOR_VERSION}.${CHART_PATCH_VERSION}"
103+
sed -i "s/^version:.*/version: ${CHART_NEW_VERSION}/" "$CHART/Chart.yaml"
104+
105+
- name: Ensure documentation is updated
106+
if: steps.list-changed.outputs.changed == 'true'
107+
uses: docker://jnorwood/helm-docs:v1.14.2@sha256:7e562b49ab6b1dbc50c3da8f2dd6ffa8a5c6bba327b1c6335cc15ce29267979c
108+
109+
- name: Commit changes
110+
if: steps.list-changed.outputs.changed == 'true'
111+
env:
112+
CHART: ${{ steps.list-changed.outputs.changed_list }}
113+
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
114+
GITHUB_HEAD_REF: ${{ github.head_ref }}
115+
run: |
116+
# Define the target directory
117+
TARGET_DIR="$CHART"
118+
119+
# Fetch deleted files in the target directory
120+
DELETED_FILES=$(git diff --diff-filter=D --name-only HEAD -- "$TARGET_DIR")
121+
122+
# Fetch added/modified files in the target directory
123+
MODIFIED_FILES=$(git diff --diff-filter=ACM --name-only HEAD -- "$TARGET_DIR")
124+
125+
# Create a temporary file for JSON output
126+
FILE_CHANGES_JSON_FILE=$(mktemp)
127+
128+
# Initialize JSON structure in the file
129+
echo '{ "deletions": [], "additions": [] }' > "$FILE_CHANGES_JSON_FILE"
130+
131+
# Add deletions
132+
for file in $DELETED_FILES; do
133+
jq --arg path "$file" '.deletions += [{"path": $path}]' "$FILE_CHANGES_JSON_FILE" > "$FILE_CHANGES_JSON_FILE.tmp"
134+
mv "$FILE_CHANGES_JSON_FILE.tmp" "$FILE_CHANGES_JSON_FILE"
135+
done
136+
137+
# Add additions (new or modified files)
138+
for file in $MODIFIED_FILES; do
139+
BASE64_CONTENT=$(base64 -w 0 <"$file") # Encode file content
140+
jq --arg path "$file" --arg content "$BASE64_CONTENT" \
141+
'.additions += [{"path": $path, "contents": $content}]' "$FILE_CHANGES_JSON_FILE" > "$FILE_CHANGES_JSON_FILE.tmp"
142+
mv "$FILE_CHANGES_JSON_FILE.tmp" "$FILE_CHANGES_JSON_FILE"
143+
done
144+
145+
# Create a temporary file for the final JSON payload
146+
JSON_PAYLOAD_FILE=$(mktemp)
147+
148+
# Construct the final JSON using jq and store it in a file
149+
jq -n --arg repo "$GITHUB_REPOSITORY" \
150+
--arg branch "$GITHUB_HEAD_REF" \
151+
--arg message "fix: post upgrade changes from renovate" \
152+
--arg expectedOid "$GITHUB_SHA" \
153+
--slurpfile fileChanges "$FILE_CHANGES_JSON_FILE" \
154+
'{
155+
query: "mutation ($input: CreateCommitOnBranchInput!) {
156+
createCommitOnBranch(input: $input) {
157+
commit {
158+
url
159+
}
160+
}
161+
}",
162+
variables: {
163+
input: {
164+
branch: {
165+
repositoryNameWithOwner: $repo,
166+
branchName: $branch
167+
},
168+
message: { headline: $message },
169+
fileChanges: $fileChanges[0],
170+
expectedHeadOid: $expectedOid
171+
}
172+
}
173+
}' > "$JSON_PAYLOAD_FILE"
174+
175+
# Call GitHub API
176+
curl https://api.github.com/graphql -f \
177+
-sSf -H "Authorization: Bearer $GITHUB_TOKEN" \
178+
--data "@$JSON_PAYLOAD_FILE"
179+
180+
# Clean up temporary files
181+
rm "$FILE_CHANGES_JSON_FILE" "$JSON_PAYLOAD_FILE"

charts/seerr-chart/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ Seerr helm chart for Kubernetes
2020

2121
Kubernetes: `>=1.23.0-0`
2222

23+
## Installation
24+
25+
Refer to [https://docs.seerr.dev/getting-started/kubernetes](Seerr kubernetes documentation)
26+
2327
## Update Notes
2428

2529
### Updating to 3.0.0

charts/seerr-chart/README.md.gotmpl

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,15 @@
1414

1515
{{ template "chart.requirementsSection" . }}
1616

17+
## Installation
18+
19+
Refer to [https://docs.seerr.dev/getting-started/kubernetes](Seerr kubernetes documentation)
20+
1721
## Update Notes
1822

1923
### Updating to 3.0.0
2024

21-
Nothing change we just rebranded `jellyseerr` helm-chart to `seerr` :)
25+
Nothing has changed; we just rebranded the `jellyseerr` Helm chart to `seerr` 🥳.
2226

2327
### Updating to 2.7.0
2428

docs/getting-started/docker.mdx

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ Refer to [Configuring Databases](/extending-jellyseerr/database-config#postgresq
1515
An alternative Docker image is available on Docker Hub for this project. You can find it at [Docker Hub Repository Link](https://hub.docker.com/r/seerr/seerr)
1616
:::
1717

18+
:::info
19+
All official Seerr images are cryptographically signed and include a verified [Software Bill of Materials (SBOM)](https://cyclonedx.org/).
20+
21+
To confirm that the container image you are using is authentic and unmodified, please refer to the [Verifying Signed Artifacts](/using-jellyseerr/advanced/verifying-signed-artifacts#verifying-signed-images) guide.
22+
:::
23+
1824
## Unix (Linux, macOS)
1925
:::warning
2026
Be sure to replace `/path/to/appdata/config` in the below examples with a valid host directory path. If this volume mount is not configured correctly, your Jellyseerr settings/data will not be persisted when the container is recreated (e.g., when updating the image or rebooting your machine).
@@ -72,11 +78,6 @@ Finally, run the container with the same parameters originally used to create th
7278
```bash
7379
docker run -d ...
7480
```
75-
:::info
76-
All official Seerr images are cryptographically signed and include a verified [Software Bill of Materials (SBOM)](https://cyclonedx.org/).
77-
78-
To confirm that the container image you are using is authentic and unmodified, please refer to the [Verifying Signed Artifacts](/using-jellyseerr/advanced/verifying-signed-artifacts) guide.
79-
:::
8081

8182
:::tip
8283
You may alternatively use a third-party updating mechanism, such as [Watchtower](https://github.com/containrrr/watchtower) or [Ouroboros](https://github.com/pyouroboros/ouroboros), to keep Jellyseerr up-to-date automatically.

docs/getting-started/kubernetes.mdx

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ sidebar_position: 5
88
This method is not recommended for most users. It is intended for advanced users who are using Kubernetes.
99
:::
1010

11+
:::info
12+
All official Seerr charts are cryptographically signed and include a verified [Software Bill of Materials (SBOM)](https://cyclonedx.org/).
13+
14+
To confirm that the chart you are using is authentic and unmodified, please refer to the [Verifying Signed Artifacts](/using-jellyseerr/advanced/verifying-signed-artifacts#verifying-signed-helm-charts) guide.
15+
:::
16+
1117
## Installation
1218
```console
1319
helm install jellyseerr oci://ghcr.io/fallenbagel/jellyseerr/jellyseerr-chart

0 commit comments

Comments
 (0)