Use GitHub Actions for CI & CD

.checkov.yaml

@@ -0,0 +1,10 @@
+directory:
+  - charts
+skip-path:
+  - /\w+/charts
+evaluate-variables: true
+framework:
+  - helm
+compact: true
+quiet: true
+soft-fail: true

.github/workflows/analysis.yml

@@ -0,0 +1,34 @@
+# https://docs.github.com/actions
+
+name: Analysis
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '43 2 * * 6'
+  workflow_dispatch:
+
+jobs:
+  checkov:
+    name: Checkov
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Checkov scanner
+        id: checkov
+        uses: bridgecrewio/checkov-action@master
+
+      - name: Upload scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+# yamllint disable rule:document-start
+# https://docs.github.com/actions
+
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  prepare:
+    name: Prepare
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.list-changed.outputs.changed }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.6.1
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --config config.yaml)
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+  test:
+    name: Test
+    if: needs.prepare.outputs.changed == 'true'
+    needs:
+      - prepare
+    uses: ./.github/workflows/test.yml
+    with:
+      action-matrix: '["lint", "install", "install --upgrade"]'
+
+  release:
+    name: Release
+    if: github.ref == 'refs/heads/main'
+    uses: ./.github/workflows/release.yml
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+    # secrets:
+    #   GPG_KEY_BASE64: ${{ secrets.GPG_KEY_BASE64 }}

.github/workflows/release.yml

@@ -0,0 +1,70 @@
+# yamllint disable rule:document-start
+# https://docs.github.com/actions
+
+name: Release
+
+on:
+  workflow_call:
+    secrets:
+      GPG_KEY_BASE64:
+        required: true
+        description: GPG key for signing
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      # - name: Prepare GPG key
+      #   run: |
+      #     gpg_dir=.cr-gpg
+      #     mkdir "$gpg_dir"
+      #     keyring="$gpg_dir/secring.gpg"
+      #     base64 -d <<< "$GPG_KEY_BASE64" > "$keyring"
+      #     echo "CR_KEYRING=$keyring" >> "$GITHUB_ENV"
+      #   env:
+      #     GPG_KEY_BASE64: ${{ secrets.GPG_KEY_BASE64 }}
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4.2.0
+
+      - name: Add Helm repos
+        run: helm repo add bitnami https://charts.bitnami.com/bitnami
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.6.0
+        with:
+          config: config.yaml
+        env:
+          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push charts to GitHub Container Registry
+        run: |
+          shopt -s nullglob
+          for pkg in .cr-release-packages/*.tgz; do
+            if [ -z "${pkg:-}" ]; then
+              break
+            fi
+            helm push "${pkg}" "oci://ghcr.io/${GITHUB_REPOSITORY@L}"
+          done

.github/workflows/test.yml

@@ -0,0 +1,45 @@
+# yamllint disable rule:document-start
+# https://docs.github.com/actions
+
+name: Test
+
+on:
+  workflow_call:
+    inputs:
+      action-matrix:
+        required: false
+        default: '["install"]'
+        type: string
+        description: Matrix of actions to run
+
+jobs:
+  ct:
+    name: Run chart-testing
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        action: ${{ fromJSON(inputs.action-matrix) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4.2.0
+
+      - uses: actions/setup-python@v5
+        if: startsWith(matrix.action, 'lint')
+        with:
+          python-version: 3.x
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.6.1
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.9.0
+        if: startsWith(matrix.action, 'install')
+
+      - name: Run chart-testing (${{ matrix.action }})
+        run: ct ${{ matrix.action }} --config config.yaml --debug

config.yaml

@@ -0,0 +1,11 @@
+owner: netbox-community
+repo: netbox-chart
+remote: origin
+target-branch: develop
+sign: false
+key: NetBox Community
+chart-dirs:
+  - charts
+chart-repos:
+  - bitnami=https://charts.bitnami.com/bitnami
+generate-release-notes: true