feat: Also publish chart to OCI registry

[mkilchhofer]

Description

See linked issue:

The helm chart of trivy-operator is published using the classic approach with a static webserver and an index.yaml (on a separate Repository https://github.com/aquasecurity/helm-charts).

$ helm repo add aqua https://aquasecurity.github.io/helm-charts/
$ helm install trivy-operator aqua/trivy-operator \
     --namespace trivy-system \
     --create-namespace \
     --version 0.20.6

In helm 3.8+ the OCI method went GA:

• https://blog.bitnami.com/2023/04/httpsblog.bitnami.com202304bitnami-helm-charts-now-oci.html?m=1
• https://helm.sh/docs/topics/registries/
• https://github.com/helm/helm/releases/tag/v3.8.0

I'd like to see you pushing the packaged helm chart(s) also on ghcr.io, alongside the container images and trivy-db's.

There is existing code available from multiple Kubernetes projects which could easily adapted:

• renovatebot/helm-charts
• nextcloud/helm
• cloudnative-pg/charts
• argoproj/argo-helm
• many more ;)

After one implemented this, users can easily install trivy-operator via:

helm install trivy-operator oci://ghcr.io/aquasecurity/charts/trivy-operator --version x.y.z

Related issues

• Close Publish helm chart(s) also as an OCI package (e.g. on GHCR registry) #1887

Remove this section if you don't have related PRs.

Testing

• I created a second branch feature/chart_oci_publish_FORK_ADAPTION with little adaption of the paths and run it inside my fork:

  git diff feature/chart_oci_publish..feature/chart_oci_publish_FORK_ADAPTION
  diff --git a/.github/workflows/publish-helm-chart.yaml b/.github/workflows/publish-helm-chart.yaml
  index d627445..7d7f539 100644
  --- a/.github/workflows/publish-helm-chart.yaml
  +++ b/.github/workflows/publish-helm-chart.yaml
  @@ -7,17 +7,19 @@ on:
      types: [publish-chart]
      paths:
        - deploy/helm/Chart.yaml
  +  # Manual trigger is also possible
  +  workflow_dispatch: {}
  env:
    CR_PACKAGE_PATH: .cr-release-packages
  -  HELM_REP: helm-charts
  -  GH_OWNER: aquasecurity
  +  HELM_REP: aquasecurity-helm-charts
  +  GH_OWNER: mkilchhofer
    CHART_DIR: deploy/helm
    KIND_VERSION: v0.17.0
    KIND_IMAGE: kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6
  jobs:
    release:
      # this job will only run if the PR has been merged
  -    if: github.event.client_payload.action == 'chart-release' || github.event.client_payload.action == 'chart-and-app-release'
  +    # if: github.event.client_payload.action == 'chart-release' || github.event.client_payload.action == 'chart-and-app-release'
      permissions:
        contents: write  # for peter-evans/repository-dispatch to create a repository dispatch event
        packages: write  # to push OCI chart package to GitHub Registry
  @@ -92,16 +94,16 @@ jobs:
              helm push "${pkg}" oci://ghcr.io/${{ env.GH_OWNER }}/${{ env.HELM_REP }}
            done
  
  -      - name: Get latest tag
  -        id: latest_tag
  -        run: |
  -          latest_tag=$(git describe --tags --abbrev=0)
  -          echo "::set-output name=tag::$latest_tag"
  +      # - name: Get latest tag
  +      #   id: latest_tag
  +      #   run: |
  +      #     latest_tag=$(git describe --tags --abbrev=0)
  +      #     echo "::set-output name=tag::$latest_tag"
  
  -      - name: Repository Dispatch Publish docs
  -        if: github.event.client_payload.action == 'chart-and-app-release' && !contains(steps.latest_tag.outputs.tag, 'rc')
  -        uses: peter-evans/repository-dispatch@v3
  -        with:
  -          token: ${{ secrets.GITHUB_TOKEN }}
  -          event-type: publish-docs
  -          client-payload: '{"action": "docs-release", "tag": "${{ steps.latest_tag.outputs.tag }}"}'
  +      # - name: Repository Dispatch Publish docs
  +      #   if: github.event.client_payload.action == 'chart-and-app-release' && !contains(steps.latest_tag.outputs.tag, 'rc')
  +      #   uses: peter-evans/repository-dispatch@v3
  +      #   with:
  +      #     token: ${{ secrets.GITHUB_TOKEN }}
  +      #     event-type: publish-docs
  +      #     client-payload: '{"action": "docs-release", "tag": "${{ steps.latest_tag.outputs.tag }}"}'
• Created a repository to simulate the central helm repository: https://github.com/mkilchhofer/aquasecurity-helm-charts
• Executed the workflow without simulating all repo dispatch events
  See: https://github.com/mkilchhofer/trivy-operator/actions/runs/8130660226/job/22219118024
• Classic chart publish works

  $ helm repo add aqua-fork https://mkilchhofer.github.io/aquasecurity-helm-charts/
  "aqua-fork" has been added to your repositories
  
  $ helm search repo aqua-fork
  NAME                    	CHART VERSION	APP VERSION	DESCRIPTION
  aqua-fork/trivy-operator	0.20.6       	0.18.5     	Keeps security report resources updated
• OCI publish also works

  $ helm show chart oci://ghcr.io/mkilchhofer/aquasecurity-helm-charts/trivy-operator
  Pulled: ghcr.io/mkilchhofer/aquasecurity-helm-charts/trivy-operator:0.20.6
  Digest: sha256:abfb2006b259fb160daf5d5b51d90928d37242790a9a89273618d41ec4b50519
  apiVersion: v2
  appVersion: 0.18.5
  description: Keeps security report resources updated
  keywords:
  - aquasecurity
  - trivyoperator
  - trivy
  name: trivy-operator
  sources:
  - https://github.com/aquasecurity/trivy-operator
  type: application
  version: 0.20.6

Checklist

• I've read the guidelines for contributing to this repository.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[mkilchhofer]

fixes warning

Warning: Unexpected input(s) 'image', valid inputs are ['version', 'config', 'node_image', 'cluster_name', 'wait', 'verbosity', 'kubectl_version', 'install_only', 'ignore_failed_clean']

[chen-keinan]

@mkilchhofer lgtm 🚀 one comment could you please to update the helm install docs accordingly with new instal command option

[mkilchhofer]

@chen-keinan I can do that. But I skipped this intentional and wanted to add this as soon as the first chart is published to OCI.

[chen-keinan]

@mkilchhofer should a small and quick change to docs , it will be great to have both so it can get merged together

[mkilchhofer]

@mkilchhofer should a small and quick change to docs , it will be great to have both so it can get merged together

@chen-keinan Alright, updated the PR. Is that okay for you like this?

[chen-keinan]

@mkilchhofer lgtm 🚀 thank you for the contribution