Merge pull request #87 from colearendt/fix-ci

Fix ci permissions

.github/workflows/chart-rebuild.yaml

@@ -1,14 +1,20 @@
+# Will be superseded by https://github.com/helm/chart-releaser/issues/133
 name: Rebuild index.yaml manually
 on:
   workflow_dispatch:
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   rebuild:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v2
         with:
+          persist-credentials: false
           ref: 'gh-pages'
           fetch-depth: 0
 
@@ -19,7 +25,7 @@ jobs:
 
       - name: Rebuild index.yaml
         env:
-          version: v1.4.0
+          version: v1.5.0
         run: |
           if [[ ! -d "$RUNNER_TOOL_CACHE" ]]; then
               echo "Cache directory '$RUNNER_TOOL_CACHE' does not exist" >&2

.github/workflows/chart-releaser.yaml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  deployments: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -13,6 +17,8 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+          persist-credentials: false
+          submodules: recursive
 
       - name: Configure Git
         run: |
@@ -25,7 +31,7 @@ jobs:
           version: v3.6.3
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.4.0
+        uses: ./.github/actions/chart-releaser-action
         with:
           charts_dir: .
           charts_repo_url: https://apache.github.io/couchdb-helm

.github/workflows/chart-test.yaml

@@ -5,6 +5,15 @@ on:
     branches:
       - main
   pull_request:
+    paths:
+      - '.github/workflows/chart-test.yaml'
+      - '.github/actions/**'
+      - 'couchdb/**'
+
+permissions:
+  checks: write
+  contents: read
+  statuses: write
 
 jobs:
   lint:
@@ -14,29 +23,18 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+          persist-credentials: false
+          submodules: recursive
 
       - name: Set up Helm
         uses: azure/setup-helm@v1
         with:
           version: v3.6.3
 
       - name: Set up chart-testing
-        uses: helm/[email protected]
-
-      - name: Run chart-testing (list-changed)
-        id: list-changed
-        run: |
-          changed=$(ct list-changed --target-branch main --chart-dirs .)
-          if [[ -n "$changed" ]]; then
-            echo "::set-output name=changed::true"
-          fi
-
-      - name: Run chart-testing (lint changed)
-        if: ${{ github.ref != 'refs/heads/main' }}
-        run: ct lint --target-branch main --chart-dirs .
+        uses: ./.github/actions/chart-testing-action
 
       - name: Run chart-testing (lint all)
-        if: ${{ github.ref == 'refs/heads/main' }}
         run: ct lint --target-branch main --all --chart-dirs .
 
   install:
@@ -46,35 +44,19 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+          persist-credentials: false
+          submodules: recursive
 
       - name: Set up Helm
         uses: azure/setup-helm@v1
         with:
           version: v3.6.3
 
       - name: Set up chart-testing
-        uses: helm/[email protected]
-
-      - name: Run chart-testing (list-changed)
-        id: list-changed
-        run: |
-          changed=$(ct list-changed --target-branch main --chart-dirs .)
-          if [[ -n "$changed" ]]; then
-            echo "::set-output name=changed::true"
-          fi
+        uses: ./.github/actions/chart-testing-action
 
       - name: Create kind cluster
-        uses: helm/[email protected]
-        if: ( steps.list-changed.outputs.changed == 'true' ) || ${{ github.ref == 'refs/heads/main' }}
-
-      # no allow-failure until https://github.com/actions/toolkit/issues/399
-      - name: Run chart-testing (install changed)
-        if: ${{ github.ref != 'refs/heads/main' }}
-        run: ct install --target-branch main --chart-dirs --upgrade .
-        continue-on-error: true
+        uses: ./.github/actions/kind-action
 
-      # no allow-failure until https://github.com/actions/toolkit/issues/399
       - name: Run chart-testing (install all)
-        if: ${{ github.ref == 'refs/heads/main' }}
-        run: ct install --target-branch main --all --chart-dirs --upgrade .
-        continue-on-error: true
+        run: ct install --target-branch main --all --upgrade --chart-dirs .

.gitmodules

@@ -0,0 +1,9 @@
+[submodule ".github/actions/chart-testing-action"]
+	path = .github/actions/chart-testing-action
+	url = https://github.com/helm/chart-testing-action.git
+[submodule ".github/actions/kind-action"]
+	path = .github/actions/kind-action
+	url = https://github.com/helm/kind-action.git
+[submodule ".github/actions/chart-releaser-action"]
+	path = .github/actions/chart-releaser-action
+	url = https://github.com/helm/chart-releaser-action.git