hotfix(actions): add missing permissions for publishing to ghcr.io #100
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Charts | |
| on: | |
| push: | |
| branches: | |
| - master | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # needed to pull git repo and create "chart-release" | |
| id-token: write # needed for signing the images with GitHub OIDC Token | |
| packages: write # for pushing and signing container images. | |
| steps: | |
| - name: Install Cosign | |
| uses: sigstore/[email protected] | |
| - name: Login to GitHub Container Registry | |
| uses: docker/[email protected] | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Configure Git | |
| run: | | |
| git config user.name "$GITHUB_ACTOR" | |
| git config user.email "[email protected]" | |
| - name: Run chart-releaser | |
| uses: helm/[email protected] | |
| env: | |
| CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Publish chart to ghcr.io | |
| run: | | |
| helm package charts/coredns | |
| helm push coredns-*.tgz oci://ghcr.io/coredns/charts | |
| rm -rf coredns-*.tgz | |
| - name: Sign artifacts with Cosign | |
| env: | |
| COSIGN_EXPERIMENTAL: 1 | |
| working-directory: charts/coredns | |
| run: |- | |
| cosign sign ghcr.io/coredns/charts/coredns:$(yq .version Chart.yaml) --yes |