flux-hr-sync.yaml

---
name: "Flux Helm Repository Sync"

on:
  workflow_dispatch:
    inputs:
      clusterName:
        description: Cluster Name
        default: main
        required: true
      helmRepoNamespace:
        description: Helm Repository Namespace
        default: flux-system
        required: true
      helmRepoName:
        description: Helm Repository Name
        required: true
  pull_request:
    branches: ["main"]
    paths: ["kubernetes/**/helmrelease.yaml"]

env:
  DEBCONF_NONINTERACTIVE_SEEN: "true"
  DEBIAN_FRONTEND: noninteractive
  APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE: DontWarn
  NIX_FLAKE_PATH: ./.github/workflows/resources/nix

jobs:
  sync:
    name: Flux Helm Repository Sync
    runs-on: ["arc-runner-set-home-ops"]
    steps:
      - name: Generate Token
        uses: actions/create-github-app-token@2986852ad836768dfea7781f31828eb3e17990fa # v1.6.2
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          token: "${{ steps.app-token.outputs.token }}"
          fetch-depth: 0

      - name: Install OS Deps
        shell: bash
        run: sudo apt-get update && sudo apt-get install -y curl git xz-utils

      - name: Install Nix
        uses: cachix/install-nix-action@7ac1ec25491415c381d9b62f0657c7a028df52a7 # v24
        with:
          github_access_token: "${{ steps.app-token.outputs.token }}"

      - name: Switch to Nix devShell
        uses: nicknovitski/nix-develop@a2060d116a50b36dfab02280af558e73ab52427d # v1.1.0
        with:
          arguments: "${{ env.NIX_FLAKE_PATH }}"

      - name: Write kubeconfig
        id: kubeconfig
        uses: timheuer/base64-to-file@784a1a4a994315802b7d8e2084e116e783d157be # v1.2.4
        with:
          encodedString: "${{ secrets.KUBECONFIG }}"
          fileName: kubeconfig

      - if: ${{ github.event.inputs.clusterName == '' && github.event.inputs.helmRepoNamespace == '' && github.event.inputs.helmRepoName == '' }}
        name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@94549999469dbfa032becf298d95c87a14c34394 # v40.2.2
        with:
          files: kubernetes/**/helmrelease.yaml

      - if: ${{ github.event.inputs.clusterName == '' && github.event.inputs.helmRepoNamespace == '' && github.event.inputs.helmRepoName == '' }}
        name: Sync Helm Repository
        env:
          KUBECONFIG: "${{ steps.kubeconfig.outputs.filePath }}"
        shell: bash
        run: |
          declare -a repos=()
          for f in ${{ steps.changed-files.outputs.all_changed_and_modified_files }}; do
              cluster_name=$(echo "${f}" | awk -F'/' '{print $2}')
              repo_namespace="$(yq '.spec.chart.spec.sourceRef.namespace' "${f}")"
              repo_name="$(yq '.spec.chart.spec.sourceRef.name' "${f}")"
              repos+=("${cluster_name}:${repo_namespace}:${repo_name}")
          done
          mapfile -t repos < <(printf "%s\n" "${repos[@]}" | sort -u)
          for r in "${repos[@]}"; do
              IFS=':' read -r cluster_name repo_namespace repo_name <<< "${r}"
              flux \
                  --context ${cluster_name} \
                  --namespace ${repo_namespace} \
                  reconcile source helm ${repo_name}
          done

      - if: ${{ github.event.inputs.clusterName != '' && github.event.inputs.helmRepoNamespace != '' && github.event.inputs.helmRepoName != '' }}
        name: Sync Helm Repository
        env:
          KUBECONFIG: ${{ steps.kubeconfig.outputs.filePath }}
        shell: bash
        run: |
          flux \
              --context ${{ github.event.inputs.clusterName }} \
              --namespace ${{ github.event.inputs.helmRepoNamespace }} \
              reconcile source helm ${{ github.event.inputs.helmRepoName }}